v0.7.9

Fixed

• The multiplexer seam no longer leaks raw subprocess timeouts. Every contract method now raises
  MultiplexerError/TmuxError or returns its documented sentinel instead of letting a 30 s tmux
  hang escape as a raw subprocess.TimeoutExpired.
• A transient tmux hang no longer crashes a run or mis-reads a working session as dead. The
  wait-loop tolerates an unknowable liveness probe — a persistent hang degrades to an honest
  timeout, never a false crashed.
• An unexpected engine exception is now recorded instead of being lost to the parked control
  window. The orchestrator writes a run-crash journal line + a crash.txt traceback, sets a
  CRASHED run status, and tears down the orphaned agent session — rather than dying with a
  traceback printed only to the pruned control pane.