Lane-GC follow-up: enroll agent timeout path in systemd scope and prove full-wrapper reap

[zxkane]

Summary

P8 (#384) keeps production signaling on the portable PGID backend because P7 scope enrollment covers lane_spawn, while the real agent chokepoint lib-agent.sh::_run_with_timeout still launches directly through setsid. A lane can therefore record scope eligibility without proving its primary agent subtree entered that scope.

The signed-off production host is already linger-enabled: loginctl show-user ubuntu -p Linger --value returns yes. P7 currently omits the username; on this host the no-user form returns an empty value with rc 0 and accidentally falls back to pgid. Correcting that probe alone could auto-enable partial scope enrollment, so the probe correction and full-wrapper enrollment must land together in this issue.

Requirements

• Change _lane_backend and adt-gc.sh --doctor to call loginctl show-user "${USER:-$(id -un)}" -p Linger --value with an explicit user
• Route _run_with_timeout agent launches through the lane's recorded systemd-scope backend when eligible
• Preserve timeout status, PID-file publication, turn-control, stdin, launcher argv, environment/credential scrubbing, and PGID recording contracts
• Keep pgid as the complete fallback when any scope prerequisite or registration step fails
• Do not permit an override to bypass the existing explicit-user Linger=yes, user-bus, and probe gates
• Update guardian/GC documentation with the full-wrapper enrollment boundary

Testing Requirements

• Unit tests cover explicit-user linger probing plus scope and PGID launch branches without weakening existing _run_with_timeout tests
• On the existing real linger-enabled user manager, run the unmodified wrapper entry point with a fixture agent that creates a re-setsid escapee
• SIGKILL the wrapper mid-run and prove the agent and escapee were present in the lane scope's cgroup.procs
• Prove guardian/GC removes the complete cgroup and leaves no live fixture process
• Repeat with scope registration failure and prove the payload runs exactly once through PGID fallback

Rollout Gate

P8 strict delayed GC accepts only exact BACKEND=pgid and refuses systemd-scope before scope or PGID signaling. Do not correct the production linger probe or remove that refusal until this issue's full-wrapper E2E evidence is attached and reviewed. Do not alter the host's current linger state as part of this work.

Dependencies

• Lane-GC P7: systemd --user scope backend — linger-gated cgroup containment (Linux enhancement) #383
• Lane-GC P8: GC enforcement flip — dry-run → kill after ≥2-week zero-false-positive soak (operator-gated) #384