fix: resolve review blockers (D1, D2, D3) and reconcile.sh subprocess bugs

.agents/skills/lib.sh

@@ -58,12 +58,6 @@ _resolve_real_herdr_path() {
 _init_herdr_isolation() {
   local wrapper_dir="$WORKSPACE_ROOT/.mam/shim"
   mkdir -p "$wrapper_dir"
-  if [ -x "$wrapper_dir/herdr" ]; then
-    if [[ ":$PATH:" != *":$wrapper_dir:"* ]]; then
-      export PATH="$wrapper_dir:$PATH"
-    fi
-    return 0
-  fi
 
   local tmp_file
   tmp_file=$(mktemp "$wrapper_dir/herdr.XXXXXX")
@@ -224,7 +218,7 @@ print('\t'.join(env_flags) + '\n' + ' '.join(binary_tokens))
     # Resolve ws_id and split direction:
     # - If we have up to 3 agents, split 'right' (columns)
     # - If we have 4 or more agents, split 'down' (rows)
-    res=$(WS_CWD="${ws:-.}" _real_herdr workspace list 2>/dev/null | python3 -c "
+    res=$(_real_herdr workspace list 2>/dev/null | WS_CWD="${ws:-.}" python3 -c "
 import sys, json, os
 try:
     target_label = os.path.basename(os.path.abspath(os.environ.get('WS_CWD', '.')))
@@ -477,7 +471,11 @@ except Exception:
 esac
 EOF
   chmod +x "$tmp_file"
-  mv -f "$tmp_file" "$wrapper_dir/herdr"
+  if [ -f "$wrapper_dir/herdr" ] && cmp -s "$tmp_file" "$wrapper_dir/herdr"; then
+    rm -f "$tmp_file"
+  else
+    mv -f "$tmp_file" "$wrapper_dir/herdr"
+  fi
   if [[ ":$PATH:" != *":$wrapper_dir:"* ]]; then
     export PATH="$wrapper_dir:$PATH"
   fi
@@ -1261,7 +1259,8 @@ isolation_env_prefix() {
   local agent="$1" root="$2"
   case "$agent" in
     claude)     printf 'CLAUDE_CONFIG_DIR=%q ' "$root" ;;
-    agy|hermes) printf 'HOME=%q https_proxy=http://127.0.0.1:9999 no_proxy=googleapis.com ' "$root" ;;
+    agy)        printf 'HOME=%q https_proxy=http://127.0.0.1:9999 no_proxy=googleapis.com ' "$root" ;;
+    hermes)     printf 'HOME=%q ' "$root" ;;
     *) : ;;
   esac
 }

.agents/skills/multi-agent-mux-monitor/scripts/reconcile.sh

@@ -131,7 +131,8 @@ for s in d.get('herdr_sessions', []):
             s['terminated_at'] = _now.strftime('%Y-%m-%dT%H:%M:%SZ')
             s['terminated_at_epoch'] = int(_now.timestamp())
             s['termination_mode'] = 'auto-detected (MQTT ' + _event + ')'
-            _cmd = ['herdr'] + (['-L', _srv] if _srv != 'default' else []) + ['kill-session', '-t', _name]
+            _shim = os.path.join(os.environ.get('WORKSPACE_ROOT', os.getcwd()), '.mam/shim/herdr')
+            _cmd = [_shim] + (['-L', _srv] if _srv != 'default' else []) + ['kill-session', '-t', _name]
             subprocess.run(_cmd, capture_output=True)
             print('MQTT Monitor: terminated + killed ' + str(_name) + ' on ' + str(_srv) + ' due to MQTT ' + _event, flush=True)
             _changed = True
@@ -309,6 +310,8 @@ import yaml
 yaml_path = os.environ['YAML_PATH']
 home = os.environ['HOME_DIR']
 claude_project_dir = os.environ.get('CLAUDE_PROJECT_DIR', f"{home}/.claude/projects")
+workspace_root = os.environ.get('WORKSPACE_ROOT', os.getcwd())
+shim_herdr = os.path.join(workspace_root, '.mam/shim/herdr')
 
 now_iso = datetime.now(timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ')
 
@@ -347,7 +350,7 @@ for s in d.get('herdr_sessions', []):
 
 try:
     for srv in sorted(unique_servers):
-        cmd = ['herdr']
+        cmd = [shim_herdr]
         if srv != 'default':
             cmd += ['-L', srv]
         cmd += ['ls', '-F', '#{session_name}|#{session_created}']
@@ -369,7 +372,7 @@ except Exception:
 
 def pane_meta(session, srv):
     try:
-        cmd = ['herdr']
+        cmd = [shim_herdr]
         if srv != 'default':
             cmd += ['-L', srv]
         cmd += ['list-panes', '-t', session, '-F',