feat: add docker_exec MCP tool for ergonomic container commands on LXCs

- New MCP tool wraps  with proper escaping
- Resolves LXC target from entity graph (no hardcoded IPs)
- Uses classifyAndGate for classification + approval chain
- Read-only commands (curl GET, cat, ls) auto-execute
- Mutations (POST/PUT/DELETE) require operator approval
- Full audit trail via execution rows
- Updates AGENTS.md with tool listing

AGENTS.md

@@ -92,6 +92,7 @@ elsewhere; regenerate from `internal/mcp/` when tools change):
     ping_service(service_slug) — HTTP reachability + scheduler health state
     list_lxcs(state) — all LXC containers with ID, host, IP, last-audited hint
     restart_service(target, service) — restart a systemd service (config_mutation, requires approval)
+    docker_exec(lxc_slug, container, command, purpose) — run a command inside a Docker container on an LXC; handles escaping, resolves target from entity graph; read-only auto-runs, mutations require approval
     push_file(target, source_path, dest_path, backup=true) — push a file into an LXC from the Proxmox host (config_mutation, requires approval)
     ack_signal(signal_id) — acknowledge an open signal
     resolve_signal(signal_id, resolution) — resolve a signal with optional note