sessions: 🐛 Let roots stop teammates after repeated stand-downs

[yasyf]

Context: On October 5, 2026, stop_unverified_task forced two owner round-trips when sweepers-delete-2 and cc-inbox kept writing after repeated STAND-DOWN messages. Stopping them required an owner answer in cc-notes, despite the owner's authorization to stop a lane that ignored two notices.

Summary: Add StoodDown evidence to sessions.task-stop. Only the root session can use it for Agent-tool teammates with ids matching <name>@session-<8 hex>. It reads the target teammate's own mailbox and requires two distinct messages from team-lead beginning with STAND-DOWN, case-insensitively, with the second at least five minutes old.

Motivation: Let roots enforce stand-downs without asking the owner again. Protect Existing Sessions remains unchanged for Orca terminals, desk runners, bare ids, and other protected sessions. Peer messages, incidental mentions, and another team's mailbox do not authorize a stop.

Details: Live evidence is keyed to the second notice's message id, permits one use, and retains the two-minute retry window. Teammate blocks report the notice count, and would_allow names the new route. A torn mailbox read counts as no notices. TestStoodDownLane covers cc-inbox, insufficient or recent notices, message filtering, duplicates, lane callers, bare ids, and mailbox isolation. An autouse HOME fixture isolates tests from real mailboxes. The grants guide documents StoodDown.