feat: surface task execution progress across Host Agent and Cloud

Host Agent now persists step-level execution detail locally (via a real
TaskMetadataStore/Timeline wired into TaskRunner) and reports a bounded
in-progress snapshot piggybacked on lease renewal. Cloud persists that
snapshot per active assignment and exposes it through the existing task
list/detail query path; Cloud Console renders it as a live badge. Host
Agent's local console gains authenticated, read-only task list and
detail/timeline pages (same-origin, server-rendered) with inlined
screenshots.

Also fixes a pre-existing gap in the shared Timeline: the actual
per-step LLM prompt is now recorded instead of the task goal, benefiting
both Runtime and Host Agent consoles. When a host uses the cloud planner
transport, each decide call's prompt and resulting tool decision are
durably logged in a new planner_decision_log table (with bounded
retention) and browsable from Cloud Console; direct-transport hosts
explicitly surface a "not reported" state.

Includes Alembic migrations 0008 (progress columns on scheduled_tasks)
and 0009 (planner_decision_log), bounded Host-Agent-local retention,
dual-backend repository parity, and Vitest + pytest coverage. Task 6.5
(manual end-to-end device verification) remains.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/cloud-platform/cloud/sdk/api.py

@@ -10,6 +10,7 @@ authentication can be added later without changing route signatures.
 
 from __future__ import annotations
 
+import json
 from typing import TYPE_CHECKING, Callable, Literal
 
 from cloud.auth import (
@@ -32,6 +33,8 @@ from cloud.sdk.models import (
     TaskAttemptResponse,
     TaskListItem,
     TaskListResponse,
+    TaskPlannerDecisionItem,
+    TaskPlannerDecisionListResponse,
     TaskStatusResponse,
     TaskSubmissionRequest,
     TaskSubmissionResponse,
@@ -144,14 +147,16 @@ def create_cloud_router(
             failure_reason=task.failure_reason,
             target_host_id=task.constraints.target_host_id,
             target_device_id=task.constraints.target_device_id,
+            progress_step_index=task.progress_step_index,
+            progress_step_status=task.progress_step_status,
+            progress_summary=task.progress_summary,
+            progress_updated_at=task.progress_updated_at,
         )
 
     @router.get("/tasks", response_model=TaskListResponse)
     def list_tasks(
         request: Request,
-        status_filter: Literal[
-            "queued", "assigned", "dispatched", "done", "failed"
-        ]
+        status_filter: Literal["queued", "assigned", "dispatched", "done", "failed"]
         | None = Query(default=None, alias="status"),
         limit: int = Query(default=50, ge=1, le=100),
         offset: int = Query(default=0, ge=0),
@@ -177,6 +182,10 @@ def create_cloud_router(
                     target_host_id=task.constraints.target_host_id,
                     target_device_id=task.constraints.target_device_id,
                     created_at=task.created_at,
+                    progress_step_index=task.progress_step_index,
+                    progress_step_status=task.progress_step_status,
+                    progress_summary=task.progress_summary,
+                    progress_updated_at=task.progress_updated_at,
                 )
                 for task in tasks
             ],
@@ -218,6 +227,47 @@ def create_cloud_router(
             for attempt in attempts
         ]
 
+    @router.get(
+        "/tasks/{task_id}/planner-decisions",
+        response_model=TaskPlannerDecisionListResponse,
+    )
+    def list_task_planner_decisions(
+        task_id: str,
+        request: Request,
+        attempt: int = Query(ge=0),
+    ) -> TaskPlannerDecisionListResponse:
+        _authorize(request, TASKS_READ_SCOPE)
+        task = scheduler.store.get_task(task_id)
+        if task is None:
+            raise HTTPException(
+                status_code=status.HTTP_404_NOT_FOUND,
+                detail=f"task {task_id!r} not found",
+            )
+        records = scheduler.store.list_planner_decisions(
+            task_id=task_id,
+            attempt=attempt,
+        )
+        items: list[TaskPlannerDecisionItem] = []
+        for rec in records:
+            try:
+                parsed_args = (
+                    json.loads(rec.arguments_json) if rec.arguments_json else {}
+                )
+            except Exception:
+                parsed_args = {}
+            items.append(
+                TaskPlannerDecisionItem(
+                    step_index=rec.step_index,
+                    attempt=rec.attempt,
+                    system_prompt=rec.system_prompt,
+                    user_prompt=rec.user_prompt,
+                    tool_name=rec.tool_name,
+                    arguments=parsed_args,
+                    created_at=rec.created_at,
+                )
+            )
+        return TaskPlannerDecisionListResponse(items=items)
+
     @router.get("/devices", response_model=list[DeviceResponse])
     def list_devices(request: Request) -> list[DeviceResponse]:
         _authorize(request, POOL_READ_SCOPE)
@@ -332,7 +382,9 @@ def _validate_task_target(pool, constraints) -> None:
         raise ValueError("target_device_id requires target_host_id")
     if constraints.target_host_id is None:
         return
-    if not any(host.host_id == constraints.target_host_id for host in pool.list_hosts()):
+    if not any(
+        host.host_id == constraints.target_host_id for host in pool.list_hosts()
+    ):
         raise ValueError(f"target host {constraints.target_host_id!r} is not known")
     if constraints.target_device_id is not None and not any(
         device.host_id == constraints.target_host_id