Automations Phase 1: runs on workspaces (nan-run, concurrency, API + SSE, CLI, UI history) #162

Part of #160. Design §4-§6, §11, §12: https://github.com/helmcode/nan-devops/blob/main/AGENT-AUTOMATIONS.md

• nan-run in the base image + Software-manager installable (Hermes + Pi adapters, events.jsonl, result.json, secret masking, systemd unit per run, git worktree isolation)
• nan-vmd: run job type + event relay
• cloud-api: runs data model, per-workspace queue with tier caps min(tier, inference headroom), POST /v1/runs, GET /v1/runs/{id}/events (SSE), cancel, entitlement checks
• Per-run LiteLLM metadata tag (run_id) for spend attribution
• nan-cli: nan run, nan runs ls|logs|cancel
• cloud-ui: run history + live log view
• E2E: 2 concurrent runs on nano, cap + queue verified