Read a channel container's stdout/stderr, live or archived.

The runtime counterpart of get_deploy_log, which only covers the build/boot window: this reads a RUNNING app's ongoing output, and — once the container is gone (a blue-green redeploy removes it) — the archive the cell wrote at removal, so a crash is still diagnosable afterwards (RUNTIME.md). The status facts (status, exit code, OOM flag, restart count) ride on every reply, so omitting command is the "just tell me how it died" query.

POST, not GET, because command is a shell pipeline: URL- encoding one is hostile, and a query string lands in Caddy's access log (and thus xhost_stats), where a grep <secret> must never go.

Auth mirrors get_deploy_log deliberately: bearer + channel ownership + the deploy:* scope both deploy-plane reads carry. The command grants the caller no authority they lack — a read-only copy of their own log inside a networkless disposable container — so resource abuse is answered by the cell's caps, not by a permission bit, and an owner-only gate would break sharing asymmetrically against get_deploy_log.