Double-start guard: launching marker, probe-and-adopt, fresh-dir relaunch; skip unreachable terminals per tick

Before the launch call the planned run (run id, terminal, handle, bookkeeping) is saved as a launching
marker. If the launch call fails or agentd dies before recording the run, the next tick probes the run
directory (exit.txt / launch.pid / pid.txt): evidence -> adopt the run; nothing -> relaunch with the same
run id in <run_id>-r2 (-r3 ...); probe unreachable -> keep the marker, which holds the terminal slot.
Transports refuse to clean a run directory holding a pid file. A terminal whose relay fails is skipped
for the rest of the tick (heartbeat.down) while other terminals carry on.

agentd/transports/local.py

@@ -4,6 +4,10 @@ import signal
 import subprocess
 from pathlib import Path
 
+from . import TransportError
+
+PID_FILES = ("pid.txt", "launch.pid")   # a run directory holding one of these is never cleaned
+
 # Shared with the remote POSIX transport (warpgate_ssh): plain sh + `date +FMT`, so it also runs on macOS.
 RUNNER = """#!/usr/bin/env bash
 cd {cwd} || {{ echo "exit=97 at $(date +%Y-%m-%dT%H:%M:%S%z) (cd failed)" > {d}/exit.txt; exit 97; }}
@@ -40,6 +44,8 @@ class LocalTransport:
         p = Path(path)
         p.mkdir(parents=True, exist_ok=True)
         if clean:
+            if any((p / n).exists() for n in PID_FILES):
+                raise TransportError("refusing to clean %s: it holds a pid file (HASPID)" % p)
             for f in p.iterdir():
                 if f.is_file():
                     f.unlink()
@@ -51,6 +57,9 @@ class LocalTransport:
         p = Path(path)
         return p.read_text(encoding="utf-8", errors="replace") if p.exists() else None
 
+    def probe(self, run_dir, names):
+        return [n for n in names if os.path.exists(os.path.join(run_dir, n))]
+
     def grep_first(self, path, needle):
         text = self.read_text(path) or ""
         return next((line for line in text.splitlines() if needle in line), None)