test(session_manager): prove agent sessions survive daemon restart/upgrade (#2335)

[harshitsinghbhandari]

Closes #2335 (the "do first" item).

Context

After tracing the runtime path end to end, #2335 was narrowed: the daemon is already disposable and agent sessions are already durable across restart/upgrade. The runtime lives out-of-process on both platforms (tmux server on Unix; detached conpty host + ptyregistry on Windows), graceful shutdown deliberately does not tear sessions down (daemon/daemon.go), and boot Reconcile adopts survivors. The one thing missing was an automated proof that this holds, which the issue flagged as "do first... if green, the bulk of this issue is closeable as already-done."

What this PR adds

TestReconcile_AdoptAcrossDaemonRestart drives the full boot-time Reconcile() pass over the exact mix of session states a daemon restart/upgrade leaves behind, and asserts sessions are decoupled from the daemon's lifetime:

• Alive orchestrator → adopted in place: same id, still live, runtime never torn down, and no new session minted. This is the id-increment regression guard (the promptless-orchestrator adoption failure that used to mint a fresh id 14→15→16).
• Alive worker → adopted as a no-op.
• Dead worker (runtime died with the daemon) → work captured into a preserve ref, restore marker written, then relaunched under its original id on the same boot; one-shot marker consumed (Killed sessions resurrect as alive after Cmd+Q restart (stale session_worktrees restore marker) #2319).
• Truly-dead, unmarked session → not resurrected (stays terminated).

Graceful ao stop and crash both converge on this same boot-time Reconcile path (shutdown does not teardown), so the test covers both.

Assessed and deferred (per the issue's own framing)

• Per-session crash circuit breaker (Decouple agent-session lifetime from daemon lifetime (survive daemon restart/upgrade) #2335 item 1): deferred. There is no auto-respawn supervisor in normal operation, relaunch happens once per boot (not a tight loop), and the only existing loop, terminal re-attach, already has its own bounded breaker (terminal/attachment.go). A 60s rolling-window breaker would guard a storm surface that does not structurally exist today. Reintroduce if an auto-respawn supervisor lands. Happy to add it in this PR if preferred.
• Terminal scrollback continuity on re-attach (Decouple agent-session lifetime from daemon lifetime (survive daemon restart/upgrade) #2335 item 3): acceptable as-is. tmux owns scrollback and re-answers the init handshake on every fresh attach; a daemon-side replay ring is not worth the complexity.

Verification

go build ./...   # clean
go vet ./...      # clean
go test ./...     # 1685 passed in 80 packages

🤖 Generated with Claude Code