agent: file_lock module, unreachable deadline-free readers, LISTEN_PID operator note

[jaredLunde]

What

This PR fixes the four low-severity items left by the audit of #139. Every testable fix has a test that fails without it: I reverted each fix in a scripted mutation run and all 5 reverts were caught.

#	Item	Fix	Proving test (fails without the fix)
1	Document the LISTEN_PID change for operators	ARCHITECTURE.md's transport section has an operator note. Launchers that pass sockets without naming the process they are for now get a startup error: systemfd --no-pid, or wrappers that start the daemon as a child (a script running serve without exec, a supervisor that forks after exporting the variables). The note gives the exact error text and the fix: drop --no-pid; exec the daemon so it keeps the pid the launcher named; or, where a wrapper must fork, set LISTEN_PID=$$ in the child right before it runs serve. It also says systemd, systemd-socket-activate and plain systemfd are unaffected.	Docs only
2	The frame-deadline lint matched BufReader::new( and stdout on one line	A reader without the deadline is now unreachable, not just discouraged. Every child-stdout read in the serve_* and mcp_* suites and tests/common goes through one helper, common::child_frames(&mut child), which takes the pipe and returns the deadline-bound Frames. That covers 272 converted sites, including common/mcp_events_fixture.rs (its bare-BufReader fixture banner read and its own Frames type, now built on the shared reader) and the mcp_* suites. The lint drops comments and all whitespace, then fails on any ChildStdout, or any .stdout.take()/as_mut/as_ref/unwrap/expect/=, outside that one helper. Line breaks and formatting cannot hide a use. It immediately found one more raw read (mcp_tasks_conformance), now converted.	serve_harness_deadlines::only_child_frames_touches_a_childs_stdout. It catches a bare reader split across lines in an mcp_* suite (which the old same-line lint missed), and the events fixture going back to a bare reader.
3	update_store_off_runtime discarded a JoinError	A panic inside a manifest write is logged at warn (with the manifest path and the error). The cache is left as it was, because the rename never happens.	mcp_manifest::tests::a_write_that_panics_is_logged_and_leaves_the_cache_as_it_was: with the error discarded, the capture is empty. It also checks that the file is unchanged and the lock was released.
4	The manifest lock reached into session_store's process-wide registry	The kernel lock (flock via File::try_lock), the same-process path registry and the inode check are now their own small module, crate::file_lock (try_lock, FileLock). The session lock (SessionLock = file_lock::FileLock) and the manifest lock both use it; session_store only names the session's lock file.	file_lock::tests (one holder at a time and free again on drop; independent paths; the moved inode check; and new: a path held in this process is refused a second time without opening the file, even if the file was replaced underneath). That last one kills dropping the registry, which the local-flock behaviour alone would hide. Also mcp_manifest::tests::the_manifest_lock_is_its_own_file_lock.

Audit gaps closed (1eccec5)

#	Gap	Fix	Proving test (fails without the fix)
G1	The lint was bypassable: std::mem::take(&mut child.stdout) (mutant T2b) survived, as would Option::take or destructuring a Child	The pipe is no longer on the Child. ChildGuard takes it at spawn and holds it, so child.stdout is None however it is reached. child_frames takes it from the guard. ChildGuard::raw_stdout() exists only for tests about the pipe itself: run_stdout_robustness uses it for its EPIPE tests, which need to close the read end. The lint is now a function over source text and flags every route: the ChildStdout type, Option methods on the field, assignment, take/replace/swap(&mut ….stdout), Child { .., stdout, .. } patterns, unguarded .spawn(), and raw_stdout. It leaves an Output's captured bytes and harness fields named stdout alone. The suites outside its scope (smoke, settings_store, run_cli_flags) now read through child_frames too, and the shared NATS server spawns guarded.	serve_harness_deadlines::the_lint_catches_every_way_to_the_pipe (15 bypass forms, single- and multi-line), the_lint_leaves_what_is_not_the_pipe_alone, and a_guarded_childs_stdout_field_is_empty_however_it_is_reached (at run time, .take(), mem::take, Option::take and as_mut all find nothing).
G2	same_file was not tested through try_lock (mutant T4)	A test-only seam in file_lock replaces the lock file between the open and the lock. try_lock must go round again and return a lock on the file now at the path.	file_lock::tests::a_lock_file_replaced_between_open_and_lock_is_not_the_one_held
G3	The lint skipped directory modules	It recurses into serve_*/mcp_* directories (tests/mcp_tasks_env/mod.rs) and all of tests/common, and asserts that it found them.	only_child_frames_touches_a_childs_stdout (a bypass planted in mcp_tasks_env/mod.rs is caught)

Rebased onto main 473af49 (which includes #140, #142 and #143). #140 added no raw stdout readers.

Proof (local, 1eccec5)

• Every beyond-ai-agent test except exec_endpoint_live (lib, all serve_*, all mcp_*): 2549/2549 passed.
• Lib suite: 1561/1561, with TMPDIR inside the worktree and with the system TMPDIR.
• clippy (-D warnings, agent + test-support + fleet-sim, all targets, code-mode), cargo fmt --check and dprint check: clean.
• Mutation runs: 5/5 killed for the original four items, 6/6 for the audit gaps (T2b, Option::take, a destructured raw Child, a bypass in a directory module, the guard leaving the pipe on the Child, T4).

CI: green on the first attempt: all 21 jobs passed (run 37582507963).

🤖 Generated with Claude Code

https://claude.ai/code/session_01JimHGjsfk2Ktm5GxyZJKKk