feat(down): self-sever guard — refuse convoy down run from INSIDE a session it would kill

[myobie]

What & why

Part 4 of 4 of the decoupling-hardening task. convoy down typed from within a session it would kill severs the caller mid-command — an agent tearing down the network it lives in, the anti-pattern that can turn a restart into a fleet-wide outage (2026-07-22).

The caller's identity is ST_AGENT (convoy bakes it into every session's env). If it names a session in the kill list, down now REFUSES with a message that names the session, unless --force (a deliberate "take me down too").

• The read-only --dry-run still previews from within — only the real teardown is gated.
• A plain human terminal (no ST_AGENT, or an identity that is not a member) is never falsely refused.

Changes

• up.ts: selfSeverSession (pure, injectable resolver) + the guard in down(), placed after the dry-run return and before the host-lock check.
• Tests: pure cases for the decision + a process-level proof — a real convoy down run as a member's identity refuses and leaves the agent alive; --force overrides; a non-member caller proceeds.

Full suite green.

Independent of parts 1–3 (touches only down() + a new test file) — mergeable in any order.

🤖 Generated with Claude Code

https://claude.ai/code/session_014gbfntB6cu21sL4YBp21LF

[myobie]

On hold per CoS: parts 3 & 4 (convoy hardening) are paused pending Nathan's morning call on swap-to-st2-and-retire-convoy vs keep-hardening. Already built + green before the hold landed; marking draft so it's not requesting review. Reopen/merge only if the decision is to keep hardening convoy.