Replaces the Live VMs card with a run-centric Executions card fed by the Gitea Actions API, reusing the OIDC login token (kept server-side, never in the unencrypted session cookie) with an optional keyring PAT fallback.
