fix(issue-23): a herdr call to another server drops the caller pane's workspace/pane/tab ids

A MAM script often runs inside one herdr server's pane (the orchestrator's)
while targeting another (the isolated MAM server). The pane exports
HERDR_WORKSPACE_ID, HERDR_PANE_ID and HERDR_TAB_ID, and those ids only mean
something on the server that issued them. They reached the scope filters as a
foreign workspace, whose fail-closed miss (ISSUE-3 / F-2b) reports a live
session as absent: has-session, kill-session, agent prompt and the delegate-job
preflight all answered "no such session". Reproduced on Linux and macOS in the
#23 comments, worked around until now with `env -u` at every call site.

mam_herdr drops the three ids for a call aimed at a named server other than the
caller's own. Scope then falls back to .mam/herdr_workspace_id and finally to
server-global, which is what _herdr_ws_scope already does. `default` is not a
crossing: it is the sentinel for "pass no session flag", so herdr answers on
the ambient server, which for a caller in a pane is that caller's own. A caller
outside any pane keeps an exported scope, so H-18/H-21/H-23 keep their meaning.

The fix lives in mam_herdr, not in the shim heredoc: that heredoc is
materialised into $WORKSPACE_ROOT/.mam/shim/herdr, one file shared by every
checkout bound to a control plane and rewritten on every herdr call, so editing
it would put unreviewed code in the control root and let two checkouts
overwrite each other. S11 fixes that invariant.

lib_py/loop/watcher.py builds its own herdr argv and is the one path that does
not go through mam_herdr, so it applies the same rule via scoped_env.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.agents/skills/lib.sh

@@ -1373,9 +1373,50 @@ EOF
   fi
 }
 
+# _herdr_call_is_cross_server
+#
+# ISSUE-23: a herdr pane exports HERDR_WORKSPACE_ID / HERDR_PANE_ID /
+# HERDR_TAB_ID, and those ids only mean something on the server that issued
+# them. When a MAM script runs inside one server's pane (the orchestrator's)
+# but targets another (the isolated MAM server named by HERDR_SESSION_NAME),
+# the inherited ids reach the scope filters (_herdr_ws_scope,
+# _herdr_agent_get_scoped, _resolve_herdr_pane_id) as a foreign workspace, and
+# their fail-closed miss (lib.sh explicit-env miss, ISSUE-3 / F-2b) reports a
+# live session as absent: has-session, kill-session, agent prompt and the
+# delegate-job preflight all answer "no such session".
+#
+# True only for a call aimed at a *named* server other than the caller's own:
+#
+#   * target unset or `default` (the lib.sh:97 fallback) is the shim's sentinel
+#     for "pass no session flag", so herdr answers on the ambient server, which
+#     for a caller inside a pane is that same caller's server - not a crossing;
+#   * no HERDR_SESSION means the caller is not in a pane at all, so an exported
+#     HERDR_WORKSPACE_ID is a deliberate scope, not a leak (H-18/H-21/H-23);
+#   * caller == target is the same server.
+_herdr_call_is_cross_server() {
+  local caller="${HERDR_SESSION:-}" target="${HERDR_SESSION_NAME:-}"
+  case "$target" in
+    ""|default) return 1 ;;
+  esac
+  if [ -n "$caller" ] && [ "$caller" != "$target" ]; then
+    return 0
+  fi
+  return 1
+}
+
 mam_herdr() {
   _init_herdr_isolation
-  "$WORKSPACE_ROOT/.mam/shim/herdr" "$@"
+  # Built as an argv array and decided inside `if`: this runs under
+  # `set -euo pipefail` in most callers, where a bare failing test would abort
+  # the whole script instead of this one call.
+  local -a _scope_strip=()
+  if _herdr_call_is_cross_server; then
+    _scope_strip=(env -u HERDR_WORKSPACE_ID -u HERDR_PANE_ID -u HERDR_TAB_ID)
+    if [ "${MAM_SHIM_DEBUG:-0}" = "1" ]; then
+      echo "mam_herdr: dropping caller pane scope ids (caller server '${HERDR_SESSION:-}' != target '${HERDR_SESSION_NAME:-}')" >&2
+    fi
+  fi
+  ${_scope_strip[@]+"${_scope_strip[@]}"} "$WORKSPACE_ROOT/.mam/shim/herdr" "$@"
 }
 
 _herdr() {