Add service container commands

[arjunkomath]

Summary

• add a dedicated Commands tab for each service with runnable-container selection and paginated audit history
• execute one-shot /bin/sh -c commands through the signed agent work queue with bounded output and timeout reporting
• restrict command execution/history to admins and developers, prevent automatic command re-leasing, and retain history for 90 days

Validation

• cd web && mise exec -- ./node_modules/.bin/tsc --noEmit
• cd web && mise exec -- pnpm test (436 tests)
• cd web && mise exec -- pnpm lint (0 errors; existing warnings only)
• cd web && mise exec -- pnpm exec oxfmt --check <changed files>
• cd agent && go test ./...
• cd agent && go build ./...
• cd agent && test -z \"$(gofmt -l .)\"
• git diff --check

Manual verification remaining

• run successful and non-zero-exit commands against a live container
• verify timeout leaves no lingering in-container process
• verify 64 KiB truncation, disappearing-container handling, reader-role denial, and history pagination

Basecamp: https://app.basecamp.com/5890597/buckets/47439993/todos/10143092964

[github-actions]

React Doctor found no issues. 🎉

⚠️ Warning: .github/workflows/react-doctor.yml is configured incorrectly. See below to fix.

React Doctor compares against main to report only the issues this pull request introduces. This run couldn't complete that comparison (usually a shallow CI checkout with no merge base), so it listed every issue in the changed files, including ones that already existed on main.

Add fetch-depth: 0 to the actions/checkout step in .github/workflows/react-doctor.yml so the checkout includes the history React Doctor needs:

 jobs:
   react-doctor:
     steps:
       - uses: actions/checkout@v5
+        with:
+          fetch-depth: 0

       - uses: millionco/react-doctor@v2

To silence this warning, set silence-missing-baseline-warning: true on the React Doctor action.

_{Reviewed by React Doctor for commit a5e207a.}