Add login-wall fleet fallback (Phase 1)

[bradbrok]

What changed

• Piggyback the existing SessionWatchdog sweep to capture enabled, active tmux panes through each session's existing tmux control and command runner.
• Detect both stable Claude login-wall signatures and require two positive sightings at least 30 seconds apart.
• Distinguish a lone-agent wall from a shared-credential fleet incident; a confirmed wall plus an uncertain shared peer fails closed and pages.
• Rename one positively walled session to login-hold-<agent> before the first fleet notification, then recapture the held pane with capture-pane -p -J and extract the current claude.com/cai/oauth URL.
• Send the login link and exact code#state reply instructions through the deployment-local owner-notification destinations registry. Missing notification configuration leaves the pane frozen, logs the URL at CRITICAL, and emits the existing explicit delivery error.
• Expose login-wall/hold state in watchdog diagnostics and document the manual Phase 1 completion path, onboarding-flag trap, and resume-from-summary dialog.

Why

A shared OAuth revocation left every TOD pane at a login wall while the daemon remained healthy and silent. Normal respawn churn repeatedly destroyed each URL's PKCE state, so recovery required a human to notice the outage, freeze a pane, extract its link, and contact the deployment's main user. This change automates that proven detection-and-handoff sequence while preserving the login state before outreach.

Scope

Phase 1 only. This PR does not correlate owner replies, paste login codes, repair onboarding state, or restart agents. No new Phase 2 auto-paste path is introduced.

Validation

• Python 3.11 affected watchdog/tmux/API/auth-relay matrix: 824 passed.
• Full Python 3.11 suite under CI-default feature flags: 4,424 passed, 3 skipped, with one unrelated host-sensitive auth expectation (/this-path-does-not-exist: 401 vs 404). The exact failure reproduces unchanged on detached origin/main at 761ca9a.
• Repository-wide uv run ruff check .: passed.
• git diff --check, compileall, and uv lock --check: passed.

Implements Phase 1 of #916.

🤖 Opened by Kuzya