fix(escrow): stop losing sessions when the retrieve handoff runs late

[arzafran]

What this does

Fixes running agent sessions dying during app relaunch (reported today: 3 workspaces updating, 1 came back as a bare shell). The reclaim protocol let the app give up on a holder after 0.5s while the holder's own handoff budget was 3.0s. A holder finishing in that gap sent the PTY fd into a connection the app had abandoned, which either killed the holder outright (uncaught SIGPIPE, taking every remaining session with it) or let the kernel destroy the fd in flight (child gets SIGHUP, dies). Either way the holder had already marked the session handed off before confirming the send, so there was no way back.

Four changes:

1. The holder ignores SIGPIPE (process-level SIG_IGN before any socket work) and every escrow socket sets SO_NOSIGPIPE, matching the pattern TerminalController already uses. A late send now fails with EPIPE instead of killing the process.
2. Client retrieve timeout 0.5s -> 5.0s, with the invariant documented: it must exceed the holder's 3.0s drain budget so the client never abandons a handoff the holder is still legitimately working on. Dead holders still fail fast (connect errors immediately); only an alive-but-wedged holder costs the full 5s.
3. The session is only marked handed off after the send is confirmed. On send failure the drain state is restored, the session goes back into the registry, and a fresh drain thread resumes on the still-open fd -- recoverable on the next relaunch instead of silently lost.
4. Release-visible diagnostics: 14 dilog call sites (escrow.retrieve / escrow.drain / escrow.conn / escrow.reattach) so the next field report comes with a timeline. Metadata only.

Review order

1. SessionEscrow.swift handleRetrieveRequest + sendRetrieveResponse (the confirm-before-handoff reorder and re-insertion path)
2. SessionEscrow.swift SIGPIPE/SO_NOSIGPIPE + timeout policy change
3. Workspace+Persistence.swift (reattach outcome logging only) + the regression test

Test plan

• CI green
• TerminalControllerSocketSecurityTests 10/10 including the new testEscrowRetrieveResponseSendSurvivesClosedPeerWithoutCrashing (reproduces the exact bind/connect/accept/closed-peer sequence; without suppressSigPipe this provably dies with SIGPIPE, exit 141 -- verified out-of-band, documented in the test since an in-suite crash would take down the whole XCTest process, which is why this is not a two-commit red/green PR)
• Manual: run 3 workspaces with live agents, trigger an update relaunch, all 3 revive

[arzafran]

cross-model review notes, for the record: two residual windows are accepted rather than fixed here. (1) a successful sendmsg still only proves the kernel queued the fd, not that the client read it; with the 5s/3s budget invariant the client no longer abandons live handoffs, so hitting this now requires the client process dying inside a microsecond window, which an ack roundtrip would only mirror, not close. (2) a holder that is alive but frozen costs 5s per session serially at launch; previously it cost 0.5s and the session. a per-socket-path circuit breaker (first timeout skips remaining retrieves against that holder) is filed as follow-up.