Daemon restarts reattach live sessions

[karngyan]

Fourth in the holder-sessions stack, on top of #102. This is the PR where the feature actually happens.

• Boot reattach: ReattachHolders dials every live holder under the holders root and rebuilds its registry entry — same id, same ring, same running child. Dead dirs are swept; the revive pass then only handles snapshots for sessions that are not already back, and clears stale ones.
• Reboot story unchanged: a holder answers SIGTERM (logout, shutdown) by writing exactly the revival snapshot the daemon used to write, agent resume hint included. Next boot revives it as before.
• Service units: systemd gains KillMode=process (the default control-group kill would reap holders on every restart — without this the feature is dead under systemd), launchd gains AbandonProcessGroup. flue restart and flue update converge the installed unit file before bouncing (new service.UnitRefresher), which is the migration path for installs from before this change.
• End to end: TestSessionsSurviveDaemonRestart builds the real binary, spawns via the real ws wire, SIGTERMs the daemon, starts a successor, and asserts the same session id is running with the same child pid and intact scrollback. Passes in ~1.4s.

Caveat worth stating: KillMode=process semantics verified by reading systemd docs, not on a live Linux box — holders left in the unit cgroup after a stop are expected to survive, but a Linux smoke before release would be good diligence.

🤖 Generated with Claude Code

[karngyan]

Linux validation done, twice over:

Real Ubuntu (x86_64, systemd user unit) — dedicated test unit flue-holdertest with KillMode=process, isolated config and port; production flue on the same box verified untouched (same pid/invocation before and after). systemctl --user restart: holder pid unchanged, child alive, new daemon logs holder reattach reattached=1 swept=0, same session id listed running. Full stop also spares holder and child; the following start reattaches again. systemd shows the survivors in the cgroup without complaint.

Docker (arm64) — full go test ./... green on Linux including TestSessionsSurviveDaemonRestart, plus the same restart/stop/start drill under a real systemd 249 in a privileged container, same results.

One CI note: in a bare container (no init as PID 1) four kill-liveness tests fail on unreaped zombies — docker run --init fixes it. Worth remembering if the suite ever runs containerized.