Agent Automations (epic): run agents in workspaces via API, CLI, webhooks and schedules #160

Design: https://github.com/helmcode/nan-devops/blob/main/AGENT-AUTOMATIONS.md

NaN community only. Iteration 1 runs inside the member's existing workspace, N concurrent runs capped by tier, inference via the workspace's LiteLLM key, per-member Vault for secrets. Iteration 2 (ephemeral executors, per-minute billing) is out of scope here.

Phases:

• Phase 0: Vault hardening (Raft snapshots to R2 + restore drill, Transit benchmark)
• Phase 1: runs (nan-run, workspace executor, concurrency/queue, API + SSE, CLI, run history UI)
• Phase 2: member Vault, automations, webhooks, schedules, approval mode, templates
• Phase 3: ephemeral executor + metered billing (separate design)