feat(nomos): session-review improvements (P0/P1/P2 from 2026-07-20 audit)

Classifier now unwraps pct exec / qm guest exec / bash -c / sh -c / sudo
and env-var assignments before classification, so read-only inspection
wrapped in pct exec no longer escalates to config_mutation. curl GET
(default method, no -d/-F/-T/-o/>) is read-only. Eliminates the three
duplicate rclone sessions (a51e2086, 8acea2e3, cb8c8a4a) that bounced
off the classifier for the same goal.

New classify_command MCP tool: command-scoped preflight that returns the
exact risk class run would assign. Documented in SOUL.md with guidance
to pre-classify before run when the verdict is uncertain.

set_goal surfaces prior partial/failed sessions from the last 24h so the
agent picks up the thread instead of rediscovering it.

completeTask auto-closes in-flight plan steps (pending/running -> done
on success, skipped on partial/failure), so one-step plans no longer
need the per-step running->done dance right before completion.

Migration 021 adds blocker + closed_at to agent_sessions. completeTask
sets closed_at once and derives a structured blocker reason
(approval_timeout, user_abandoned, classifier_overreach, model_refusal,
tool_error, ...) from the last assistant message.

/sessions list now carries message_count, tool_call_count,
duration_seconds (server-side aggregates — no more N+1 transcript
fetches to audit a fleet). GET /sessions/{id} returns both metadata
and messages. New query params filter + paginate: outcome, status,
entity_id, blocker, since (RFC3339 or Go duration), cursor, limit.

Titles now prefer the goal when set; sessions without a goal fall back
to the first assistant text.

New GET /sessions/{id}/tool_calls flat view for audit scripts.

Plan: plans/2026-07-20-session-review-ten-sessions.md. VERSION 0.7.12 -> 0.7.13.

nomos/SOUL.md

@@ -59,6 +59,14 @@ is a pure-DB Q&A that called *no* `run` at all (only get_entity/list_lxcs/
 search_knowledge): answer directly, `complete_task` with a one-line summary,
 no writeback needed.
 
+`complete_task` auto-closes any in-flight plan steps (pending/running → done
+on success, → skipped on partial/failure). You do NOT need to call
+`update_plan_step` for every step right before completing — once your work
+is done and writeback is recorded, just call `complete_task`. This is the
+right pattern for one-step plans (greetings, single health checks, title
+tests): propose_plan → answer → complete_task, skipping the per-step
+running→done dance entirely.
+
 ### 7. ITERATE — follow-ups reopen the task
 A `complete_task` is not the end of the conversation. If the operator sends
 a follow-up on a completed session — e.g. "now look into the X you flagged"
@@ -160,6 +168,17 @@ disappear.
   `declared_risk`. The `request_execution` fixed-enum tool is RETIRED
   (2026-07-14) — use `run` for EVERYTHING: restarts, apt upgrades, pct exec,
   pct create, any shell command. There is no named-action tool anymore.
+- `classify_command` — **pre-flight check before `run` when you're unsure
+  whether a command will auto-execute or need approval.** Pass the exact
+  command (and optional `declared_risk`); get back the risk class that `run`
+  would assign. Use it whenever you're composing `pct exec`, `curl`, or any
+  compound command — these are the cases where the classifier's verdict
+  isn't obvious from the verb alone. If `classify_command` says `read_only`,
+  `run` will auto-execute; if it says `config_mutation`, reframe the command
+  or expect to need approval. **Do NOT submit a `run`, get it queued for
+  approval, and then retry with cosmetic variations** — that produces
+  duplicate queued approvals and wastes turns. Pre-classify, adjust, then
+  submit once.
 - `http_get` — fetch a public web page / GitHub README / raw file and get sanitized text.
   You CAN read the internet with this. When asked to deploy a service from a URL or repo,
   call `http_get` on the repo README (or `.../raw/main/docker-compose.yml`) to learn its