Add orchestrator view and privileged commands

[webdevcody]

Summary

• Add a persisted AgentRole and daemon-gated orchestrator command surface (list, read, send, spawn, review) over the existing unix-socket protocol.
• Add a chat-first orchestrator TUI mode with an attention-ordered session chip strip, F10 toggle, and orchestrator_view = auto|always|never mobile default.
• Add a tabbed Review modal shell (Terminal/Diff/History/PR) opened from orchestrator commands or status chips, with the terminal tab reusing the live pane.
• Document the design in docs/orchestrator.md and update README, commands, keys, and configuration docs.

Design decisions

• Permission model is daemon-enforced by persisted row role (orchestrator), not by prompt text. Normal agents can know the command names and still be refused.
• Attention feed uses explicit polling/listing plus visible chips instead of injected system notes. This avoids unsolicited model input and keeps permission prompts tell-and-ask by default.
• Spawn-anywhere reuses daemon worktree creation and agent creation. Omitting --worktree targets the project main checkout; naming a missing branch cuts it through existing worktree logic.
• Mobile default is width-based (auto at <= 60 columns), with always/never overrides and an F10 runtime toggle.

Verification

• cargo +stable fmt --all --check
• cargo +stable build --locked
• cargo +stable test -p nebula-core -p nebula-daemon -p nebula-tui --lib
• cargo +stable test -p nebula --test e2e_pty
• cargo +stable test -p nebula-daemon orchestrator
• cargo +stable test -p nebula-tui review_modal

Note: cargo +stable test --workspace passed unit/browser/config/e2e_pty portions, then hung in tui_drag_past_the_pane_top_autoscrolls_and_copies_the_run; the process was stopped after several minutes with no new output.

Follow-ups

• Embed the existing full diff and PR readers directly inside the Review modal tabs instead of the current first-pass placeholders.
• Add transcript-backed History summaries per harness.
• Add optional idle-note injection/autonomy settings once the permission UX is explicit.
• Add screenshot scenes for wide and narrow orchestrator layouts.

  

[claude]

role is never persisted: row_to_agent hardcodes AgentRole::Worker, and this PR changes no schema, insert_agent, or SELECT column list (grep role store.rs shows only test fixtures). So every agent loaded from the store is a Worker, and require_orchestrator (crates/nebula-daemon/src/orchestrator.rs, agent.role != AgentRole::Orchestrator) always bails. The whole orchestrator command surface (list/read/send/spawn/review) is unusable. The unit test only_orchestrator_role_can_use_privileged_list should also fail, since it inserts an Orchestrator row and expects orchestrator_tree to succeed. The PR description says the role is "persisted", but there is no migration or column.

Fix: add a role column with a migration, write it in insert_agent, and read it here. Alternatively, build the role from the stored value instead of hardcoding it.

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.