fix(reset): refuse id-less claude/grok targets, gate submit during a reset, validate the spec (#78)

Review round 1 of PR #82:
- A running claude/grok row without a recorded id is refused by the
  precheck (stop would fill it with a folder-wide guess the purge then
  deletes); record-id never records a pre-assigned guess, and a target is
  skipped (id_unverified) when the row's id after the normal stop is not
  the one recorded before it.
- reset takes the update admission lock exclusively while it publishes
  .mam/loop-guard-active and .mam/reset-in-progress; delegate submit
  refuses on a live reset marker (mam_reset_admit). Before each target's
  stop its open jobs are re-read (skipped as open_job, never cancelled),
  and a row whose agent/server no longer matches the spec is skipped.
- read_spec validates every stored field (herdr_server required, never
  defaulted) and rejects duplicate names.
- Signal tests wait 60 s for the kill-session gate (this Mac needs ~18 s).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.agents/skills/lib.sh

@@ -3348,6 +3348,23 @@ mam_update_admit_release() {
   eval "exec ${1:-7}>&-"
 }
 
+# Issue #78: a reset (multi-agent-mux-reset) publishes .mam/reset-in-progress
+# under the exclusive admission lock before its precheck. Delegate submit checks
+# it while it holds that workspace's admission, so a job is either registered
+# before the reset's precheck (which refuses on it) or not at all.
+# mam_reset_admit [workspace]: rc 0 no live reset, 1 refused (stderr).
+mam_reset_admit() {
+  local root="${1:-$WORKSPACE_ROOT}" marker st
+  marker="$root/.mam/reset-in-progress"
+  [ -f "$marker" ] || return 0
+  # shellcheck disable=SC1091
+  declare -F _mam_lock_holder_state >/dev/null || source "$SKILL_DIR/multi-agent-mux-loop/scripts/loop_lock.sh"
+  st="$(_mam_lock_holder_state "$marker")"
+  [ "$st" != "stale" ] || return 0
+  echo "ERROR: a reset of $root is in progress (marker $marker, holder $st); its agents are being purged and recreated; try again when it has finished" >&2
+  return 1
+}
+
 # mam_update_admit_at <cwd>: what create and resume take for an agent they
 # start in <cwd> - mam_update_admit for the control root (fd 7) and for every
 # other installed workspace at or above <cwd> (fds 20 and up), whose update