feat(down): self-sever guard — refuse convoy down run from INSIDE a session it would kill - #108

… session it would kill

Part 4 of 4 of the decoupling-hardening task. `convoy down` typed from within a session it would
kill severs the caller mid-command — an agent tearing down the network it lives in, the anti-pattern
that can turn a restart into a fleet-wide outage (2026-07-22).

The caller's identity is ST_AGENT (convoy bakes it into every session's env). If it names a session
in the kill list, `down` now REFUSES with a clear message that names the session, unless --force (a
deliberate "take me down too"). The read-only --dry-run still previews from within — only the real
teardown is gated. A plain human terminal (no ST_AGENT, or an identity that is not a member) is never
falsely refused.

- up.ts: `selfSeverSession` (pure, injectable resolver) + the guard in `down()`, placed after the
  dry-run return and before the host-lock check.
- Tests: pure cases for the decision + a process-level proof (real `convoy down` run as a member's
  identity refuses and leaves the agent alive; --force overrides; a non-member caller proceeds).

Independent of parts 1-3 (touches only down() + a new test file); mergeable in any order.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014gbfntB6cu21sL4YBp21LF