feat: robust provisioning (DNS self-heal) + live execution feedback in chat

Production session provisioned the container but the service never installed:
apt failed with "Temporary failure resolving deb.debian.org" — a static-IP LXC
whose assigned nameserver couldn't resolve. The operator also got zero feedback:
the approval banner just sat there with no running/complete/failed status.

Backend robustness (provisionScript):
- Wait for real DNS/connectivity inside the container before apt, and self-heal
  /etc/resolv.conf to a public resolver (1.1.1.1/8.8.8.8) if the assigned one
  is dead. `set -e` after the gate so apt/post_install failures surface.
- apt-get update/install with Acquire::Retries=3.

Frontend feedback (InlineApproval):
- After approve, poll GET /executions/{id} and show live phase: submitting →
  provisioning… → provisioned successfully / execution failed (with the error).
- add getExecution() to api.ts.

Agent guidance (SOUL.md):
- omit vmid (auto-assigned), prefer dhcp, docker-compose-plugin is not in Debian
  (use docker.io + get.docker.com), end post_install with a health check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nomos/SOUL.md

@@ -66,6 +66,18 @@ Before calling `request_execution`:
   `git clone && docker compose up -d`). Prefer one pct_create with services+post_install
   over pct_create followed by many pct_exec approvals. Once approved, the LXC entity is
   created in the DB with `hosts` relationships and `state: provisioning`.
+  - **vmid**: omit or set 0 — a free cluster id is assigned automatically. Never reuse an
+    existing container's id.
+  - **networking**: prefer `"ip":"dhcp"` unless the operator needs a fixed address; DHCP
+    yields a working DNS resolver. If you set a static CIDR, the provisioner self-heals DNS
+    to a public resolver when the gateway can't resolve, but DHCP is more reliable.
+  - **Docker**: `docker-compose-plugin` is NOT in Debian's repos — do not put it in
+    `services`. For Docker, put `docker.io` in `services` (it provides the engine) and, if
+    you need compose v2, install it in `post_install` from Docker's official convenience
+    script (`curl -fsSL https://get.docker.com | sh`). Use `docker compose` (v2) only after
+    that, otherwise use `docker-compose` (v1, from docker.io).
+  - **verify**: end `post_install` by confirming the service actually answers (e.g.
+    `curl -fsS http://localhost:<port>/` ), so a green result means it truly works.
 - If `destructive` or `config_mutation`: escalate to operator
 - If `reversible_low` with validated pattern: auto-act allowed