Get account overview

One read-only call that situates a caller with no prior history: servers (agent id, version, state), apps and environments, domains, open alerts, recent deployment failures (scrubbed signatures) and the suggested next actions with the exact tool to call. When the credential is a subcredential with a resource allowlist, every section is filtered to it and each affected section carries filtered: {section, showing, of}. No metrics, no logs, no write actions, no addresses or e-mails.