v1.0.6

Fixed

• tunnel stop could kill processes that have nothing to do with the tunnel.
  It ran pkill -f "127.0.0.1:8766:127.0.0.1:8765", which matches any command line
  containing that string: a shell that happens to be running the same command,
  an editor with the forward spec open, a log tail. Stopping a tunnel could take
  an unrelated session down with it.

  The tunnel is now started as a detached child whose PID is recorded in the
  state directory, and stop kills exactly that process — after confirming from
  its command line that it really is an ssh carrying this forward, because a PID
  is only unique among live processes and whatever recycled it is innocent. The
  anchored pattern match remains as the fallback for a tunnel started by an older
  version or by hand.

  ssh -f was the reason the PID could not be recorded before: it double-forks,
  so the child's PID is gone before it could be written down. Detaching the
  spawn instead keeps the child alive past this CLI process while leaving its PID
  ours to record.

Changed

• The daemon's /agent now reports ok: false when the vision loop runs out of
  steps or out of its wall-clock budget instead of returning a confident success
  containing no answer. BROWSER_AGENT_VISION_BUDGET_SEC sets the budget.