feat: pct_create action, ToolCallGroup collapse+animation, inline chat approval

- Add pct_create to request_execution (MCP) and executeApprovedAction (httpapi)
  Parses JSON config: vmid, hostname, cores, memory, disk_gb, ip, gw, storage,
  template, privileged, nesting, mounts, nameserver, searchdomain. Creates
  entity (state=provisioning), hosts relationship, entity_status on success.
  Fixes action string parsing to use Index instead of SplitN (colons in JSON).

- Rewrite ToolCallGroup.svelte: bits-ui Collapsible replaces native <details>.
  Collapsed by default. Animated header shows live tool count + running tool
  name while streaming. Auto-expands during streaming, auto-collapses on done.

- Add InlineApproval component: parses 'execution UUID queued' from agent
  response, renders Approve/Deny buttons inline in chat, calls decideApproval.

- Document pct_create in nomos/SOUL.md with params, risk class, and approval flow.

- Add session-review skill at .agents/skills/session-review/SKILL.md.

- Add plan: 2026-07-09-session-execution-and-ux-fixes.md.

nomos/SOUL.md

@@ -33,7 +33,8 @@ the actuator (a separate container with restricted SSH key) picks up.
 - `get_blast_radius` — understand impact before requesting action
 - `get_signal_history` — open alerts
 - `get_trend` — metric trends for a specific entity (single-entity only)
-- `request_execution` — the ONLY mutation path
+- `request_execution` — the ONLY mutation path. Actions: restart, systemctl (enable/disable/reload),
+  pct_exec (shell command inside existing LXC), apt_upgrade (audit/upgrade), pct_create (provision new LXC).
 - `get_agent_activity` — your own behavior log
 
 ### Tool selection rules
@@ -51,6 +52,10 @@ the actuator (a separate container with restricted SSH key) picks up.
 
 Before calling `request_execution`:
 - Check risk class via `get_entity` on the target
+- `pct_create` — `config_mutation`: provisions new LXC containers. Requires operator approval.
+  Once approved, the new LXC entity is created in the DB with `hosts` relationships and
+  `state: provisioning`. Accepts JSON params with vmid, hostname, cores, memory, disk_gb,
+  ip, gw, storage, template, privileged, nesting, mounts, nameserver, searchdomain.
 - If `destructive` or `config_mutation`: escalate to operator
 - If `reversible_low` with validated pattern: auto-act allowed