fix: chat-assent chicken-and-egg + agent stops after errors

Three fixes for the session where the agent proposed a plan, waited
for 'proceed', then re-queued instead of being auto-approved:

1. Chat-assent fallback: when the operator says 'proceed' but the
   preceding turn had NO pending approvals (agent proposed plan in text
   without calling request_execution), inject a system note telling the
   agent to execute the plan now. Opens the assent window so subsequent
   config_mutation commands auto-run.

2. SOUL.md: instruct agent to ALWAYS call request_execution/run when
   proposing a plan, not wait for 'proceed' first. This ensures a
   pending approval exists for chat-assent to grant.

3. SOUL.md: stronger Docker instructions — Debian 13's docker.io package
   installs the daemon but NOT the docker CLI binary. Must use
   get.docker.com in post_install. Added 'handling errors' section:
   diagnose, try alternatives, continue — don't stop after one failure.

cmd/nomos/agent.go

@@ -233,6 +233,15 @@ func (a *agent) chat(ctx context.Context, sessionID, message string, emit func(a
 			note := fmt.Sprintf("[System: execution(s) %s are classified DESTRUCTIVE and were NOT approved by loose assent — you must ask the operator for an explicit typed confirmation before they can run.]", strings.Join(blocked, ", "))
 			messages = append(messages, openai.SystemMessage(note))
 		}
+	} else if assent && len(lastAssistantCalls) == 0 {
+		// The operator said "proceed"/"go ahead"/"yes" but the preceding
+		// assistant turn had NO pending approvals — meaning the agent
+		// proposed a plan in text and asked "shall I?" without calling
+		// request_execution yet. Inject a system note telling the agent
+		// the operator approved — go execute the plan now.
+		note := "[System: The operator approved your proposed plan. Execute it now — call request_execution or run to carry out the steps you described. Do not re-describe the plan or ask for confirmation again. The assent window is active: config_mutation commands will auto-run once you create them.]"
+		messages = append(messages, openai.SystemMessage(note))
+		a.openAssentWindow(ctx)
 	}
 
 	for i := 0; i < maxIterations; i++ {