dashboard: spawn form moves under approvals; docs synced

submitting R3QU3ST SP4WN immediately queues an approval that lands
in the very next list. the form belonged with that list, not at the
top of containers — the agent doesn't exist yet at form time anyway.

docs: claude.md grows operator_questions.rs / events.rs sqlite /
broker vacuum to the file map; web-ui shape lists the actual current
endpoint set (per-agent cancel/compact/history, dashboard tombstone
purge/answer/spawn); live-view section now describes the state
badge, sticky-bottom scroll, history backfill, and the terminal-
embedded prompt with its slash commands; dashboard-action-surface
rewritten around the new six-section page (containers / kept-state /
questions / inbox / approvals / message-flow) and the two-line
container row. new 'persistence + retention' section documenting both
sqlite databases and their vacuum cadences. readme picks up the new
mgr mcp surface (start/restart/ask_operator) + operator-side
features list + ask_operator answer flow.

todo trimmed of shipped items (bigger terminal / sticky scroll /
cancel button / /compact trigger / /cancel command). new entry for
the two-step spawn-with-preconfig flow.

TODO.md

@@ -34,28 +34,10 @@ Pick anything from here when relevant. Cross-cutting design notes live in
   `napping 😴` once the `/compact` trigger and `nap` tool exist —
   both need a harness signal (an explicit `LiveEvent::StateChange`
   variant or piggyback on Note).
-- **Terminal: slash commands beyond /help and /clear.** Operator-facing
-  in-terminal commands still to add: `/model`, `/compact`, `/cancel`.
-  Each needs harness-side support (model override, force compaction,
-  cancel current claude turn).
-- **Terminal: bigger.** The 32em max-height is cramped on a 1080p+
-  screen. Grow it (e.g. `min(70vh, 60em)`) so the live tail is the
-  main visual element of the page rather than a strip.
-- **Terminal: sticky-bottom auto-scroll.** Today every appended row
-  scrolls to bottom, so the view shifts while the operator is reading
-  scrolled-up. Track whether the user is *already* at the bottom
-  (within a small threshold), and only auto-scroll when that's true.
-  Show a small "↓ N new" indicator when not at bottom; click to jump.
-- **Terminal: cancel-current-turn button.** Explicit "kill claude
-  process for this turn" control. Harness needs to track the
-  in-flight claude child PID and offer a `/cancel` endpoint that sends
-  SIGTERM; UI surfaces a button while the state badge is `thinking`.
-  Slash-command equivalent: `/cancel`.
-- **`/compact` trigger.** Operator-initiated compaction of the current
-  claude session — `claude --print --continue` with `/compact` over the
-  same session id. Surfaces as a slash command in the terminal + a
-  toolbar button while the state badge is `idle`. Sets state to
-  `compacting` during the run.
+- **Terminal: `/model` slash command.** Operator-typeable model
+  override from the terminal. Depends on the model-override work
+  above; once an override mechanism exists, wire a `/model <name>`
+  command that POSTs to a new endpoint.
 - **xterm.js terminal** embedded per-agent, attached to a PTY exposed by
   the harness. Pairs well with the unprivileged-container work — would let
   the operator drop into the container without `nixos-container root-login`.
@@ -87,6 +69,25 @@ Pick anything from here when relevant. Cross-cutting design notes live in
   manager fall back. Wire the timeout into `OperatorQuestions::wait_answered`
   and surface remaining-time on the dashboard.
 
+## Spawn flow
+
+- **Two-step spawn.** Today `request_spawn(name)` is one shot: manager
+  asks → operator approves → container is created with a default
+  `agent.nix` and empty `/state/`. Manager has no way to pre-stage
+  per-agent prompt material, package additions, or initial notes before
+  the agent first wakes. Split into:
+  1. `request_spawn_draft(name)` — host creates the per-agent
+     `proposed/` repo (initial commit) and `state/` dir with no
+     container; manager now has `/agents/<name>/{config,state}/` to
+     edit + commit just like an existing agent.
+  2. `request_spawn_commit(name, commit_ref)` — submits the queued
+     approval; operator sees the diff in the dashboard like a normal
+     `apply_commit`; on approve the container is created from that
+     commit.
+  Backwards-compat: keep the existing one-shot `request_spawn` for
+  trivial agents (operator can still type a name in the dashboard).
+  Surface "drafts" as a new section between K3PT ST4T3 and approvals.
+
 ## Loop substance
 
 - **`nap` tool.** Agent-side MCP tool `mcp__hyperhive__nap(seconds)` that