todo: stream nixos-container output so slow != stuck

surfaced by a real hang investigation today — lifecycle::run
uses .output() which buffers stdout/stderr until exit, so a
multi-minute nix build through nixos-container update looks
identical to a wedged daemon. line-buffered streaming into
tracing (and ideally the per-agent live event bus when the
agent is known) makes 'still building, just slow' visible
without strace gymnastics.

TODO.md

@@ -89,6 +89,17 @@ Pick anything from here when relevant. Cross-cutting design notes live in
   eye on; if it gets renamed too, sync_agents stops being
   able to seed a fresh meta repo.
 
+- **Stream `nixos-container update` stdout into tracing.**
+  Today `lifecycle::run` calls `.output()` which buffers
+  until exit, so a 5-minute rebuild looks identical to a hang
+  in the journal — only the success/failure summary lands. Pipe
+  stdout + stderr line-by-line into tracing (or into the
+  per-agent live event bus when we know which agent) so the
+  operator sees `building '/nix/store/…drv'` / `copying path …`
+  in real time and can tell "slow" from "stuck." Same applies to
+  every other `nixos-container` shellout that takes
+  meaningful time (`create`, `update`).
+
 ## Bugs
 
 - **Pending question doesn't always appear on the dashboard.**