feat: robust provisioning (DNS self-heal) + live execution feedback in chat

Production session provisioned the container but the service never installed:
apt failed with "Temporary failure resolving deb.debian.org" — a static-IP LXC
whose assigned nameserver couldn't resolve. The operator also got zero feedback:
the approval banner just sat there with no running/complete/failed status.

Backend robustness (provisionScript):
- Wait for real DNS/connectivity inside the container before apt, and self-heal
  /etc/resolv.conf to a public resolver (1.1.1.1/8.8.8.8) if the assigned one
  is dead. `set -e` after the gate so apt/post_install failures surface.
- apt-get update/install with Acquire::Retries=3.

Frontend feedback (InlineApproval):
- After approve, poll GET /executions/{id} and show live phase: submitting →
  provisioning… → provisioned successfully / execution failed (with the error).
- add getExecution() to api.ts.

Agent guidance (SOUL.md):
- omit vmid (auto-assigned), prefer dhcp, docker-compose-plugin is not in Debian
  (use docker.io + get.docker.com), end post_install with a health check.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/src/lib/api.ts

@@ -230,6 +230,12 @@ export async function fetchExecutions(status?: string): Promise<Execution[]> {
   return data.items ?? []
 }
 
+export async function getExecution(id: string): Promise<Execution | null> {
+  const res = await fetch(`${API}/executions/${id}`)
+  if (!res.ok) return null
+  return res.json()
+}
+
 export async function cancelExecution(id: string): Promise<Execution | null> {
   const res = await fetch(`${API}/executions/${id}/cancel`, { method: 'POST' })
   if (!res.ok) return null