todo: approval history tab; retire streaming-output entry

new entry under UI/UX for an approval history tab on the
P3NDING APPR0VALS section — sqlite already has every row + the
applied repo's annotated denied/failed tags carry the
human-readable reasons, so this is a render-side change.

retire the 'stream nixos-container stdout' entry — landed in
6f1b664. run() now pipes child output line-by-line into
tracing so 'slow build' no longer looks like 'wedged daemon'.

TODO.md

@@ -66,17 +66,6 @@ Pick anything from here when relevant. Cross-cutting design notes live in
   eye on; if it gets renamed too, sync_agents stops being
   able to seed a fresh meta repo.
 
-- **Stream `nixos-container update` stdout into tracing.**
-  Today `lifecycle::run` calls `.output()` which buffers
-  until exit, so a 5-minute rebuild looks identical to a hang
-  in the journal — only the success/failure summary lands. Pipe
-  stdout + stderr line-by-line into tracing (or into the
-  per-agent live event bus when we know which agent) so the
-  operator sees `building '/nix/store/…drv'` / `copying path …`
-  in real time and can tell "slow" from "stuck." Same applies to
-  every other `nixos-container` shellout that takes
-  meaningful time (`create`, `update`).
-
 ## Bugs
 
 - **Pending question doesn't always appear on the dashboard.**
@@ -99,6 +88,19 @@ Pick anything from here when relevant. Cross-cutting design notes live in
 
 ## UI / UX
 
+- **Approval history tab on P3NDING APPR0VALS.** Today the
+  section renders pending rows only; once approved / denied /
+  failed they drop off the dashboard. Sqlite still has every
+  row (approvals table never deletes), and the meta git log +
+  applied repo's annotated `denied/<id>` / `failed/<id>` tags
+  already carry the human-readable reasons. A second tab —
+  `pending | history` — that scrolls the last N resolved
+  approvals with their terminal status, `resolved_at`
+  timestamp, operator note (deny), build error (failed), and
+  a quick link/diff to the `proposal/<id>` tag would close
+  the loop so the operator can see "what went out, what got
+  rejected, why" without ssh-ing to the host.
+
 - **Web UI for config repos + meta deploy log.** Browse
   per-agent proposed / applied tags
   (`proposal/* / approved/* / building/* / deployed/* /