logs: read a box's journal and container logs in one merged stream (TailBoxLogs RPC, containarium logs) #3643

Problem

To read what is running on a box, a user has to open a shell in it and run journalctl, docker logs or podman logs by hand. No daemon RPC reads the box's journal or the logs of containers running inside it. TailBoxRunLog covers only a coding-agent run.

Proposal

Add ContainerService.TailBoxLogs (GET /v1/containers/{username}/logs) that returns one window of the box's logs, merged across sources and ordered by time, plus a containarium logs <box> CLI subcommand and an MCP box_logs tool that wrap it (CLI first).

• Sources: the systemd journal (label = unit, or syslog identifier when there is no unit) and every container running in the box (docker or podman).
• Read is a window with an opaque resume cursor; follow_seconds (0..10) long-polls like TailBoxRunLog, so there is no server stream.
• Same access rule as TailBoxRunLog.
• Collection is one fixed script exec'd in the box. Only integers, timestamps, a strictly validated journal cursor and unit names matching a strict pattern are passed; container names are compared, never executed. Output is treated as untrusted: strict frame parser, hard size limit, invalid UTF-8 replaced. The script times itself out and caps its output.
• Merge in the daemon: k-way by receipt time with a small settle margin so a late line from a slower source is not skipped.
• A stopped box is reported as such; it is not started and its disk is not read.

Acceptance criteria

• A box running one systemd unit and one container returns lines from both, labelled and time-ordered.
• Passing the returned cursor back resumes with no duplicate and no lost line across windows.
• --since, --tail, and unit/container filters work; an unknown filter returns InvalidArgument listing valid names.
• A caller without access to the box gets the same error as for TailBoxRunLog.
• A hostile log line (control bytes, invalid UTF-8, a 1 MB line) cannot break parsing or exceed the window caps.
• No handler hand-rolled outside grpc-gateway; protobuf first, enums for source kind and status.
• containarium logs and the MCP tool call the same RPC.

Open checks

• Does the exec seam work for podman-backed and rootless boxes?
• Which log driver do container runtimes default to on supported images?

Estimate: build ~1 day (size:L) + review.