M7 epic: Lab CLI, project linkage, and artifacts

[Andreas-Froyland]

Tracking issue. Dependency and status checklists only — implementation stays in narrow linked issues.

Outcome

Humans and agents can obtain, use, and release a Lab environment from the CLI and API, and collect artifacts from a run.

Supersedes

Replaces agents-registry test <profile> and the "run tests -> collect artifacts" scope items of #3, and the agent/CI test-environment workflow in #2.

Depends on

• M7 leases and cleanup
• FM-110 — authenticated API/web/CLI vertical slice (M1)

Scope checklist

• fleetctl lab create/status/exec/destroy --output json
• Artifact and log metadata with digest, owner, retention, and location
• Project linkage so a lease records what it was for
• Web presentation of active leases and their expiry

Constrained by

• docs/PLAN.md — M7; ADR-0002: fleetctl JSON matches public DTOs
• SQLite stores artifact metadata; the artifact store holds the bytes

Non-goals

• Fleet becoming a test framework or CI system; it provisions and invokes them
• Browser or desktop automation engines inside Fleet