fix(jobs): subshell-guard exit/exec so the sentinel always prints

[tomfordweb]

Closes beads issue sidemux-6e2.

Problem

A command containing exit or exec as a word terminates (or replaces) the pane's shell before the appended ; printf '<<SMUX…>>' sentinel runs. The sentinel then exists nowhere — not in the pane, not in the pipe-pane log — so the #29 log fallback can't help, and the job reports running until its full timeout. Observed live: a 360s wait burned on a job that finished in ~90s (grep -c SMUX <log> = 0).

Fix

buildLaunchBody wraps only commands matching exit/exec as a word in a posix subshell:

( echo bye; exit 7 ); printf '\n<<SMUX:%s:%d>>\n' 'jxxxxxx' $?

• exit/exec end the subshell; the outer shell survives to print the sentinel.
• Exit code passes through unchanged (( exit 7 ) → 7).
• The pane survives and stays reusable — previously it died and the run reported unknown with no code.
• Everything else launches exactly as before (no blanket wrapping; the never-wrap design holds for normal commands). fish is left unwrapped — it has no subshell operator, and a fish exit closing the pane is settled by pane-death handling.
• Known cosmetic trade-off, documented: a guarded command's cd/env changes don't persist in the pane.

Detection-based alternatives (settle when the shell is childless and quiet) were rejected: they false-settle pure-builtin loops and bare read prompts.

Tests

• Unit: wrap decisions incl. word-boundary cases (pnpm run exit-lint, echo \"exit\" stay unwrapped; fish never wraps).
• Integration (real tmux): echo pre-exit-probe; exit 7 settles status=exit, code 7, pane intact — this exact case previously ran to wait-timeout.
• Updated the service test that asserted the old unknown/dead-pane behavior to the new, strictly better outcome.

Full gate green (typecheck, lint, test, build).