fix(host_agent): gate "deployed" on agent check-in; fail no-op runs

A failed provision looked successful in two ways:

1. The host panel showed the agent as deployed (metrics + Update/Rotate/Remove)
   because provision/deploy mint the registration row BEFORE the playbook runs
   and the panel keyed "installed" on that row. Now gated on the agent actually
   checking in (reg.last_seen_at). Three states: reporting (metrics + lifecycle),
   pending (token minted but no check-in → "no metrics yet, deploy may be
   running/failed" banner + retry + Clear pending registration), and none
   (install path).

2. The run reported success though nothing ran — ansible-playbook exits 0 on
   "no hosts matched"/empty inventory. The executor now treats an empty PLAY
   RECAP (returncode 0 but no hosts executed) as failed, with a clear failure
   note. Non-zero exits and recap failed/unreachable were already caught.

Scribe issue #887.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plugins/host_agent/routes.py

@@ -548,13 +548,16 @@ async def host_panel(host_id: str):
 
     hostlvl = latest.get(host.name, {})
     ls = reg.last_seen_at if reg else None
-    stale = bool(reg) and (
-        ls is None or (datetime.now(timezone.utc) - ls).total_seconds() > _stale_after_seconds())
+    # "Deployed" is gated on the agent actually checking in (last_seen_at), NOT on
+    # the registration row — that row is minted before the playbook runs, so a
+    # failed provision would otherwise look deployed.
+    reporting = bool(reg) and ls is not None
+    stale = reporting and (datetime.now(timezone.utc) - ls).total_seconds() > _stale_after_seconds()
 
     ansible_cfg = current_app.config.get("ANSIBLE", {})
     return await render_template(
         "panel.html",
-        host=host, reg=reg, hostlvl=hostlvl, stale=stale, target=target,
+        host=host, reg=reg, hostlvl=hostlvl, reporting=reporting, stale=stale, target=target,
         ansible_available=has_capability("ansible.run_playbook"),
         managed_key_set=bool((ansible_cfg.get("ssh_public_key") or "").strip()),
     )