feat(adopt): adopt tmux sessions a human started outside Codeman

The home screen now lists tmux sessions Codeman did not start (a claude or
codex running inside `tmux new -s work`, or just a shell); one click turns one
into a tab you can keep working in.

Adoption is a fourth LOCATION OVERLAY, structurally identical to remote/docker,
and NOT a new SessionMode: the outer layer is still an ordinary
codeman-<8hex> wrapper session on this instance's own socket, and only the pane
inside it runs the attach. Session-name allowlisting, capture, input and the
recovery chain are therefore untouched, and "detach, never kill the foreign
session" becomes structural rather than a rule to remember — killSession can
only ever reach our own wrapper.

All three locations share one probe script, one parser and one classifier, and
differ only in the shell around them (direct exec / docker exec / ssh). Pane
mode is decided from the bounded process-tree argv of pane_pid, because claude
and codex both report `node` as pane_current_command; anything unrecognised is
treated as a shell.

Things measured rather than assumed:
- A grouped session buys only `status off` and an independent current window,
  not an independent size. Measured on tmux 3.3a: both a bare attach and a
  grouped one shrink the other client's 200x49 to 80x23. Only
  `window-size largest` preserves it, but that is a shared window option that
  survives our departure, so it is not set.
- View reclamation: local relies on client death, ssh on SIGHUP, but a
  `docker exec` does not die with its client — the container-side view must be
  reclaimed explicitly on kill or every adoption leaks one.
- The session name is chosen by someone else, while the local launch chain ends
  in `bash -c` plus JSON.stringify, which does not escape `$` or backticks, so
  the outer shell performs substitution before the inner single quotes close.
  Session names and socket paths therefore pass a character allowlist and are
  discarded during DISCOVERY, so a non-conforming candidate never gets an id.

Capability degrades by "who started this process": an adopted session has no
hooks, no envOverrides and no effort, and its working directory is merely the
foreign pane's cwd at that moment (possibly not even on this host). Respawn,
Ralph, the orchestrator, hook waits, and every watcher that tails the local
filesystem by workingDir are refused or skipped, and the close dialog no longer
offers a "kill the session" option it cannot honour.

test/docker-adopted-container.test.ts

@@ -212,8 +212,15 @@ describe('adopted container: the host is not required to have the CLI', () => {
     expect(unguarded).toHaveLength(0);
   });
 
-  it('derives the flag from the docker metadata the session already carries', () => {
-    expect(src).toContain('const cliRunsInContainer = !!docker;');
+  it('derives the flag from the location metadata the session already carries', () => {
+    // Adoption joined the condition for the same reason docker is in it: an
+    // adopted session's CLI was started by a human in a process Codeman never
+    // spawned, so the host binary is irrelevant there too — and demanding it
+    // would reject adopting a claude that lives in a container, on an ssh host,
+    // or simply outside the server process's PATH (the systemd/launchd case).
+    // What the assertion still pins is that the flag comes from the session's
+    // OWN metadata rather than from anything ambient.
+    expect(src).toContain('const cliRunsInContainer = !!docker || !!adopt;');
   });
 });