feat: surface task execution progress across Host Agent and Cloud

Host Agent now persists step-level execution detail locally (via a real
TaskMetadataStore/Timeline wired into TaskRunner) and reports a bounded
in-progress snapshot piggybacked on lease renewal. Cloud persists that
snapshot per active assignment and exposes it through the existing task
list/detail query path; Cloud Console renders it as a live badge. Host
Agent's local console gains authenticated, read-only task list and
detail/timeline pages (same-origin, server-rendered) with inlined
screenshots.

Also fixes a pre-existing gap in the shared Timeline: the actual
per-step LLM prompt is now recorded instead of the task goal, benefiting
both Runtime and Host Agent consoles. When a host uses the cloud planner
transport, each decide call's prompt and resulting tool decision are
durably logged in a new planner_decision_log table (with bounded
retention) and browsable from Cloud Console; direct-transport hosts
explicitly surface a "not reported" state.

Includes Alembic migrations 0008 (progress columns on scheduled_tasks)
and 0009 (planner_decision_log), bounded Host-Agent-local retention,
dual-backend repository parity, and Vitest + pytest coverage. Task 6.5
(manual end-to-end device verification) remains.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

openspec/changes/task-execution-progress-visibility/specs/host-agent-console-task-pages/spec.md

@@ -0,0 +1,34 @@
+## ADDED Requirements
+
+### Requirement: Host Agent local console exposes step-level status for the current assignment
+The Host Agent's local console SHALL display, for its currently executing assignment, the current step index, step status, and a short summary, sourced from the Host Agent's local task metadata store, refreshed on the console's existing polling interval.
+
+#### Scenario: An assignment is currently executing
+- **WHEN** an operator views the Host Agent local console dashboard while an assignment is executing
+- **THEN** the dashboard shows the current step index, step status, and a short summary for that assignment, updating on subsequent polls
+
+#### Scenario: No assignment is currently executing
+- **WHEN** an operator views the dashboard while the Host Agent is idle
+- **THEN** the dashboard shows no in-progress step information
+
+### Requirement: Host Agent local console exposes read-only task history with per-step detail and screenshots
+The Host Agent's local console SHALL provide authenticated, read-only pages listing recently executed tasks and, for a selected task, its full per-step history including any captured screenshots, sourced from the Host Agent's local task metadata store and timeline.
+
+#### Scenario: Operator lists recent tasks
+- **WHEN** an authenticated operator opens the Host Agent local console's task list page
+- **THEN** it shows tasks from the local task metadata store, most recent first, including tasks that have already reached a terminal state
+
+#### Scenario: Operator inspects a completed task's step history
+- **WHEN** an authenticated operator opens the detail page for a specific completed task
+- **THEN** the page shows each recorded step in order, including its tool call, result, and any captured screenshot
+
+#### Scenario: Unauthenticated request
+- **WHEN** a request to the task list or task detail pages is made without a valid Host Agent console session
+- **THEN** the Host Agent rejects the request the same way it rejects unauthenticated requests to its other console pages
+
+### Requirement: Host Agent local console task pages require no new cross-origin surface
+The Host Agent local console's task pages SHALL be served same-origin from the Host Agent's existing web application, without introducing new CORS allowances or a dependency on the separate Runtime `console/` frontend.
+
+#### Scenario: Task pages are requested
+- **WHEN** an operator's browser requests the Host Agent local console's task pages
+- **THEN** the pages are served by the Host Agent's own application using its existing session/CSRF protections, with no additional cross-origin configuration required