fix: refuse one-shot prompts on an adopted session (release review)

`POST /api/sessions/:id/run` had no adopted gate, so while the wrapper had no
attached PTY it spawned `claude -p --dangerously-skip-permissions <prompt>`
in /tmp, a launch every other adopted route refuses.

The route answers INVALID_INPUT, and `runPrompt()` refuses too, which also
covers the legacy `sendInput()` path and leaves no direct spawn in Session
that an adopted session can reach.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/session.ts

@@ -4581,6 +4581,8 @@ export class Session extends EventEmitter {
     prompt: string,
     options?: { model?: string; onProgress?: (info: { tokens?: number; status?: string }) => void }
   ): Promise<{ result: string; cost: number }> {
+    // ⚠️ A one-shot `claude -p` is a new local process in `/tmp`, never the agent in that pane.
+    if (this._adopt) throw new Error('One-shot prompts are not available for adopted sessions');
     if (this.guardedInputHeld) {
       this._guardedInputRevision++;
       throw new Error('Guarded submission in progress');

src/web/routes/session-routes.ts

@@ -2070,6 +2070,15 @@ export function registerSessionRoutes(
     const { prompt } = parseBody(RunPromptSchema, req.body);
     const session = findSessionOrFail(ctx, id, req);
 
+    // Its own check: `runPrompt` starts a new local claude, and the answer has to say so
+    // here rather than as a `session:error` after a success.
+    if (session.isAdopted) {
+      return createErrorResponse(
+        ApiErrorCode.INVALID_INPUT,
+        'One-shot prompts are not available for adopted sessions: Codeman did not start this agent'
+      );
+    }
+
     if (session.isBusy()) {
       return createErrorResponse(ApiErrorCode.SESSION_BUSY, 'Session is busy');
     }