feat: pct_create action, ToolCallGroup collapse+animation, inline chat approval

- Add pct_create to request_execution (MCP) and executeApprovedAction (httpapi)
  Parses JSON config: vmid, hostname, cores, memory, disk_gb, ip, gw, storage,
  template, privileged, nesting, mounts, nameserver, searchdomain. Creates
  entity (state=provisioning), hosts relationship, entity_status on success.
  Fixes action string parsing to use Index instead of SplitN (colons in JSON).

- Rewrite ToolCallGroup.svelte: bits-ui Collapsible replaces native <details>.
  Collapsed by default. Animated header shows live tool count + running tool
  name while streaming. Auto-expands during streaming, auto-collapses on done.

- Add InlineApproval component: parses 'execution UUID queued' from agent
  response, renders Approve/Deny buttons inline in chat, calls decideApproval.

- Document pct_create in nomos/SOUL.md with params, risk class, and approval flow.

- Add session-review skill at .agents/skills/session-review/SKILL.md.

- Add plan: 2026-07-09-session-execution-and-ux-fixes.md.

web/src/pages/Chat.svelte

@@ -3,6 +3,7 @@
   import SessionRail from '$lib/components/SessionRail.svelte'
   import SessionGraph from '$lib/components/SessionGraph.svelte'
   import ToolCallGroup from '$lib/components/ToolCallGroup.svelte'
+  import InlineApproval from '$lib/components/InlineApproval.svelte'
   import { Button } from '$lib/components/ui/button'
   import { Textarea } from '$lib/components/ui/textarea'
   import ArrowUpIcon from '@lucide/svelte/icons/arrow-up'
@@ -113,6 +114,7 @@
             {:else}
               <div class="flex w-full flex-col gap-2">
                 <ToolCallGroup tools={msg.tools} active={$streaming && i === $messages.length - 1} />
+                <InlineApproval text={msg.text} />
                 {#if msg.text}
                   <div class="prose-chat max-w-none text-sm leading-relaxed">
                     <!-- eslint-disable-next-line svelte/no-at-html-tags — sanitized via DOMPurify -->