fix(agent-isolation): show the touch overlay for agent-run git on Linux

[potiuk]

Summary

• The touch overlay never appears for a git commit / push the agent runs on Linux. arm gave the watcher $PPID as its owner, but Claude Code runs a hook command through sh -c, so $PPID is that shell — which exits the moment the hook returns. The parent-liveness check in _watch then ends the watch on its first poll, before the key has blocked. The wrap path (commits from the operator's own terminal) passes $$ and is unaffected, which is why the overlay still shows there.
• arm now resolves the owner by walking up from $PPID past shell processes to the harness itself, and uses that pid for the watcher's parent check, the registration's owner (so the next arm's sweep does not kill a live session's watcher), and the h-<pid> owner id fallback. Where the harness starts the hook directly (possibly macOS), the walk stops at $PPID and nothing changes.

Type of change

• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Other: tools/agent-isolation hook script + its regression test

Test plan

• New test_watcher_outlives_the_shell_the_hook_ran_in arms through sh -c 'bash gpg-touch-overlay.sh arm'; it fails on main (the registered owner is the exited sh, not the test process) and passes with the fix.
• uv run pytest in tools/agent-isolation — all tests pass (run outside the Claude Code sandbox: test_agent_socket_rows_follow_the_connections_held_open needs socket(AF_UNIX), which the Linux sandbox's seccomp filter rejects).
• prek run on the changed files passes.
• End to end on Linux (Ubuntu, GNOME, YubiKey via gpg-agent ssh socket): before the fix the watcher log showed kill -0 <sh pid> failing and break on the first iteration; after it, the watcher tracked the claude process, counted the blocked polls, and raised the GTK overlay during a git ls-remote over ssh.

RFC-AI-0004 compliance

• Sandbox — no new host access; the hook still runs outside the sandbox as before, it only reads ps for its own ancestors.

Linked issues

Regression from #1296, which added the parent-liveness check.

Notes for reviewers (optional)

The shell names skipped are sh, bash, dash, zsh (plus login-shell - forms). A harness that wraps hooks in some other interpreter would still hit the old behaviour; widening the list is cheap if one turns up.

🤖 Generated with Claude Code