fix: detect detached Codex session lock holder

[Onetech2]

Intent

Allow a detached Codex tool runner to acquire the Firstmate session lock only when exactly one live harness is rooted in the Firstmate repo, while preserving fail-closed behavior for ambiguous or unrelated harnesses.

What Changed

• Adds a detached-runner fallback that acquires the session lock only when exactly one recognized harness is rooted in the Firstmate repository.
• Deduplicates interpreter wrappers from their direct harness processes and rejects ambiguous, unrelated, or differently rooted candidates.
• Adds focused lock behavior coverage and updates related documentation and test fixtures.

Risk Assessment

🚨 High: Captain, the fallback fixes the previously reported candidate-selection defects, but an unrelated interpreter ancestor can still bypass the new rooted, exactly-one-harness boundary and acquire the session lock.

Testing

Completed 1 recorded test check.

• Outcome: ⚠️ 1 error across 2 runs (10m5s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

⚠️ **Review** - 1 error

• 🚨 bin/fm-lock.sh:41 - This contradicts the required “only when exactly one live harness” behavior: whenever any direct harness exists, all interpreter-hosted candidates are discarded. A direct codex process and a separate Node-hosted claude process rooted here therefore produce one candidate and acquire the lock despite two live harnesses. Count all identified harnesses at this shared candidate-selection boundary; suppress an interpreter only when it is proven to wrap the same direct harness.
• 🚨 bin/fm-lock.sh:33 - This contradicts the requirement to fail closed for unrelated harnesses. The argument regex treats any repo-rooted Node/Python process with a standalone argument such as --model codex as a harness; if it is the only match, the detached runner writes that unrelated PID into the lock. Identify the interpreter's executable/script entrypoint rather than searching its complete argument list for a harness word.

🔧 Fix: Captain, fix detached harness candidate detection
1 error still open:

• 🚨 bin/fm-lock.sh:76 - The required “only when exactly one live harness is rooted in the Firstmate repo” invariant remains bypassable: a detached runner whose ancestry includes an unrelated Node/Python process with an argument such as --model codex returns that ancestor immediately, without checking its cwd or calling root_harness_pid(). Restrict interpreter ancestry detection to the executable/script entrypoint (using the same semantics as the fallback) so unrelated ancestors fail closed.

⚠️ **Test** - 1 error

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"

🔧 Fix: Captain, stabilize backend and session-start tests
1 error still open:

• 🚨 tests failed with exit code 1
• command -v tmux >/dev/null || { echo "tmux is required for e2e tests" >&2; exit 1; }; tmux -V; rc=0; for t in tests/*.test.sh; do echo "== $t =="; bash "$t" || rc=1; done; exit "$rc"

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.