fix: adopted tmux targets, hung servers and the attach chain (release review)

Names tmux reads as target syntax (`@1`, `%1`, `=eq`, a bare `~`) passed the
has-session guard by name and then joined something else in new-session -t:
another session, or a fresh shell on the foreign server. They are refused at
discovery now, and take the existing skipped note.

One stopped tmux server emptied the whole local list and left a stuck client
per scan. Each server now gets a bounded ping with stdout at /dev/null first,
because a tmux client hands dups of its stdout to the server: a stopped server
holds our pipe open after the client is dead, so a watchdog around list-panes
cannot work. The probe runs in its own process group, all three transports
keep the rows read before a failure, and a missed ping becomes a note.

The attach and the probe pass -u, so a POSIX-locale container no longer garbles
the tab or lists a non-ASCII name as underscores. A docker attach gets the same
TERM and COLORTERM an owned container's exec gets.

A missing tmux no longer reads as "session is gone", and the launch line's `$`
now reaches bash unexpanded, so the ssh attach's PATH line is expanded at the
far end, as the probe's already was.

fix-plan/write, fix-plan/read and ralph-prompt/write refuse an adopted session:
its workingDir is the neutral /tmp, so they read and wrote a predictable name
in a folder anyone can write to.

FOREIGN_MAX_SOCKETS is gone: it capped nothing, and a real cap in glob order
would never reach `default` on a box with many `codeman-*` sockets (this one
has 212). Closing an adopted tab re-reads the outside-sessions list.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/config/foreign-tmux.ts

@@ -3,9 +3,12 @@
  * outside Codeman).
  *
  * Two facts drive every number here. First, the number of tmux sockets and panes
- * on a machine is NOT under Codeman's control — a discovery walk with no ceiling
- * is an unbounded loop over data someone else produces, so sockets and panes are
- * both hard-capped. Second, an ssh handshake is an order of magnitude slower than
+ * on a machine is NOT under Codeman's control, so a discovery walk with no ceiling
+ * is an unbounded loop over data someone else produces. Parsed rows are capped by
+ * count and the socket sweep by time: a sweep capped by count would stop in glob
+ * order, where `codeman*` sorts before `default` and a machine running many
+ * instances would never reach the sessions this feature is for. Second, an ssh
+ * handshake is an order of magnitude slower than
  * a local `exec`; reusing the shared 5s `EXEC_TIMEOUT_MS` would classify every
  * remote host as unreachable, so the probe gets its own timeout.
  *
@@ -25,8 +28,15 @@ export const FOREIGN_CACHE_TTL_MS = 5000;
 /** Timeout for one probe invocation (local exec, `docker exec`, or one ssh). */
 export const FOREIGN_PROBE_TIMEOUT_MS = 12000;
 
-/** Max tmux sockets inspected per location, oldest-first by directory order. */
-export const FOREIGN_MAX_SOCKETS = 16;
+/**
+ * How long one tmux server may take to answer the probe's ping, in the script's own
+ * `sleep`, so whole seconds. A healthy server takes milliseconds. One that misses this
+ * costs only its own rows, and the sweep moves on to the next socket.
+ */
+export const FOREIGN_SOCKET_TIMEOUT_SECONDS = 2;
+
+/** How long a timed-out probe's process group gets on SIGTERM before SIGKILL. */
+export const FOREIGN_PROBE_KILL_GRACE_MS = 2000;
 
 /** Max pane rows parsed from one probe. Panes past this are dropped, not errors. */
 export const FOREIGN_MAX_PANES = 400;