Show live multi-agent activity without leaving a room

[jusso-dev]

Context

Adapt the useful interaction from Buzz PR #2915 to Muster. When several permission-scoped agents work in the same room, operators need one compact place to see what is active and drill into a run without navigating away.

Proposed behaviour

• Show a small View all action beside the existing activity indicator only when two or more agents are actively working in the current room.
• Open a right-side panel containing one compact card per working agent. Exclude idle, stopped, and unrelated agents.
• Each card shows agent identity, bounded current/recent activity, run state, and a single View action that opens the full append-only run timeline.
• Tail the latest meaningful activity; do not lead with session setup noise.
• Close on Escape, explicit close, or room change. Preserve the current single-agent interaction unchanged.
• Clamp activity headlines and strip secrets, raw tool arguments, commands, environment values, and untrusted evidence payloads.

Muster constraints

• PostgreSQL remains authoritative for run identity, organisation, lifecycle, and persisted timeline. Redis/BullMQ signals may accelerate updates but must not define durable state.
• Scope every query and subscription by organisation and room.
• Treat agent/tool output as untrusted evidence, never instructions.
• Preserve append-only run, timeline, evidence, and audit records.
• Keep long-running work outside HTTP handlers.

UI direction

Match Buzz's simplicity: one conditional control, one reusable side panel, compact cards, and progressive disclosure. Do not add a separate activity dashboard, dense metrics, or multiple competing actions.

Acceptance criteria

• View all appears only for 2+ actively working agents in the current room.
• Panel lists only organisation- and room-scoped active agents.
• Cards show bounded, secret-safe recent activity and link to full run detail.
• Single-agent behaviour remains unchanged.
• Escape, close, and room-switch behaviour work on desktop and mobile layouts.
• Server-side authorisation protects activity and run details.
• Unit tests cover active-agent selection, scoping, headline bounds, and stale/idle exclusion.
• Browser test covers opening the panel and drilling into one run using synthetic data.

[jusso-dev]

Parent: #21

Additional low-effort reference: block/buzz#2962. Reuse existing run/timeline activity to enrich the same compact agent cards with current location, state, elapsed time, and latest real completion. No separate dashboard or new backend model.

[jusso-dev]

Implemented and deployed in c5af1df.

• Added organisation- and room-scoped live agent activity projection with freshness, deadline, stop, and kill-switch rules.
• Added compact single-agent state plus multi-agent panel, bounded redacted headlines, latest completion, and append-only timeline drill-down.
• Added unit coverage for scoping, freshness, one-run-per-agent selection, redaction, bounds, and completion projection.
• Added Chromium coverage for multi-agent, single-agent, stale/unrelated exclusion, timeline, keyboard/mobile/room-switch close, and anonymous denial.
• Full 22-package check passed. CI: https://github.com/jusso-dev/Muster/actions/runs/30219865236
• Security/supply chain passed: https://github.com/jusso-dev/Muster/actions/runs/30219865232
• Public amd64 image deployed and live-tested: ghcr.io/jusso-dev/muster:sha-c5af1df@sha256:79bae2bb80f464f8e95e4639e99623d4cb8a70709f4f3ce3f39de4ac2f989d1e
• Runtime health, zero restarts, preserved PostgreSQL counts, rollback assets, and operator handbook verified.