fix(issue-5): address phase 1 cross-review findings (R1, R2, F-1)

Three reviewers examined fc0bd96..8def235. Codex and Claude each reproduced a
defect; all three findings were re-verified here before being accepted, and none
were rebutted.

R1 (codex) — the shell helpers ran `python -m lib_py.delegation.cli`. For -m,
sys.path[0] is the working directory, which therefore beats PYTHONPATH: with cwd
inside a tree containing lib_py, the live package won even with the frozen path
listed first. The documented B-13 guarantee for this path did not hold.
Reproduced, then replaced with an explicit bootstrap that inserts SKILL_DIR
itself. cwd is left alone, because the registry and audit-log paths are relative
to it. The file-based shim path was never affected.

R2 (codex) — the persistent connection was reused on host and port alone. Two
jobs sharing an endpoint but carrying different credentials or TLS settings
silently published over the first connection. Reproduced (the client factory ran
once, under the first account, with TLS off). The guard now compares an
immutable snapshot of the whole connection identity and names only the differing
field, never its value.

F-1 (claude) — paho queues a publish issued while disconnected and raises
RuntimeError from wait_for_publish. RuntimeError is deliberately outside the
retry tuple, so the one state a persistent connection exists to survive, the gap
between a drop and paho's reconnect, failed on the first attempt. Confirmed
against paho 2.1.0. That single condition is now translated into a retryable
error; the tuple is unchanged, so genuine programming errors are still not
retried.

Two fixtures were hiding these: FakeInfo had no rc and never raised. It now
mirrors paho's contract, which is what makes the new tests meaningful.

Also folds in the duplication both Claude (O-1) and I had flagged: the CLI path
kept its own copy of connect-publish-disconnect plus its own timeout constants.
_publish_once now delegates to OneShotPublisher.publish_raw, so a transport fix
lands once. Having two copies is exactly why these bugs existed in one of them.

Documentation corrected rather than defended: the benchmark's rationale for
keeping three forks was imprecise (the || true already guarantees rc 0; the
lookup buys quietness and legacy parity), SKILL.md no longer claims PYTHONPATH
decides the frozen path, and the daemon's directory creation is recorded as a
deliberate difference. Trailing whitespace inherited by the relocated file is
stripped, so the commit range is now clean too.

Verified: each regression fails against the pre-fix code and passes after
(R1 1, R2 4, F-1 1). 66 phase-1 tests pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UrDNJkHmm18uu7n7JwV5Qd

.agents/skills/lib.sh

@@ -1949,6 +1949,23 @@ _start_watchdog_legacy() {
 # loop run frozen delegation code.
 # ---------------------------------------------------------------------------
 
+# _delegation_py <cli-args...>
+# Run the delegation CLI from *this* tree.
+#
+# NOT `python -m`: for -m, sys.path[0] is the current directory, which therefore
+# beats PYTHONPATH. A frozen loop whose cwd happened to contain a lib_py package
+# would silently execute live code, losing B-13. An explicit insert of SKILL_DIR
+# cannot be shadowed that way. cwd is deliberately left alone, because the
+# registry and audit-log paths are relative to it.
+_delegation_py() {
+  PYTHONPATH="$SKILL_DIR:${PYTHONPATH:-}" "$(_delegate_py_bin)" -c '
+import sys
+sys.path.insert(0, sys.argv[1])
+from lib_py.delegation.cli import main
+sys.exit(main(sys.argv[2:]))
+' "$SKILL_DIR" "$@"
+}
+
 # delegate_submit_job <prompt> <agent> <agent_session>
 # Register a job. Prints the new JID on stdout and nothing else.
 delegate_submit_job() {
@@ -1960,8 +1977,7 @@ delegate_submit_job() {
     echo "ERROR: multi-agent-mux-delegate-job registry.py not found under .agents/skills/" >&2
     return 1
   fi
-  PYTHONPATH="$SKILL_DIR:${PYTHONPATH:-}" "$(_delegate_py_bin)" -m lib_py.delegation.cli \
-    submit --prompt "$prompt" --agent "$agent" --agent-session "$session"
+  _delegation_py submit --prompt "$prompt" --agent "$agent" --agent-session "$session"
 }
 
 # delegate_publish_event <job_id> <event> [detail]
@@ -1974,8 +1990,7 @@ delegate_publish_event() {
   local pub
   pub="$(_delegate_script publish_event.py)"
   [ -n "$pub" ] && [ -f "$pub" ] || return 0
-  PYTHONPATH="$SKILL_DIR:${PYTHONPATH:-}" "$(_delegate_py_bin)" -m lib_py.delegation.cli \
-    publish --job "$job_id" --event "$event" --detail "$detail" || true
+  _delegation_py publish --job "$job_id" --event "$event" --detail "$detail" || true
 }
 
 # ensure_subscriber_daemon <job_id> [workdir]
@@ -1983,8 +1998,7 @@ delegate_publish_event() {
 # Prints the PID(s) on stdout, exactly as start_watchdog always did.
 ensure_subscriber_daemon() {
   if [ "${MAM_DELEGATION_PY:-1}" = "0" ]; then _start_watchdog_legacy "$@"; return $?; fi
-  PYTHONPATH="$SKILL_DIR:${PYTHONPATH:-}" "$(_delegate_py_bin)" -m lib_py.delegation.cli \
-    ensure-daemon --job "$1" --workdir "${2:-$PWD}"
+  _delegation_py ensure-daemon --job "$1" --workdir "${2:-$PWD}"
 }
 
 # start_watchdog — retained name; create_session.sh and operator docs use it.