feat: structured __renderer envelopes for MCP tools

All 19 oikos tools now return JSON envelopes with __renderer hints
(terminal, service_status, ping, path_report, etc.) carrying structured
data alongside the model-facing prose in a `message` field — agent
behavior is unchanged while the UI renders native cards.

Fixes: ping_service SQL (json||text precedence), timestamptz scan,
run:{...} action prefix parsing, get_execution_status target slug join.

Also: deploy.sh step 5.5 restarts dsh web after API deploy; watchdog
LaunchAgent detects API recovery and kickstarts dsh web for stale MCP
sessions.

scripts/oikos-api-health-watchdog.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+# Oikos API health watchdog — if the oikos API restarts while dsh web holds a
+# stale MCP session, every tool call fails with "session not found" until dsh
+# web itself restarts. This monitor detects the transition and triggers a
+# launchd kickstart so the connection recovers automatically.
+#
+# Runs every 30s via LaunchAgent network.hubris.oikos-api-watchdog.
+
+set -e
+
+API_URL="${API_URL:-http://localhost:8090/healthz}"
+MARKER="${MARKER:-/tmp/.oikos-api-down}"
+
+if curl -sf -o /dev/null --max-time 3 "$API_URL"; then
+  if [ -f "$MARKER" ]; then
+    rm -f "$MARKER"
+    echo "oikos API recovered — restarting dsh web"
+    launchctl kickstart -k "gui/$(id -u)/network.hubris.dsh-web" 2>/dev/null || true
+  fi
+else
+  touch "$MARKER"
+fi