fix(stop): a purge waits for the agent process, not only the herdr session (Issue #31)

A closed herdr session is not an exited agent, and the `herdr already dead`
path ran no check at all, so stop could remove the files of a live claude
and then its row. New `python -m lib_py.agents in-use <agent> <uuid> [ws]
[--wait s]` gives the purge CLI's own verdict; stop asks it outside the
registry lock and, unless it answers free, exits 4 with nothing changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.agents/skills/multi-agent-mux-stop/scripts/stop_session.sh

@@ -282,6 +282,23 @@ if [ "$PURGE" = "1" ] && [ "$HERDR_ALIVE" = "1" ]; then
   fi
 fi
 
+# Purge process gate (Issue #31): a closed herdr session is not an exited
+# agent - the process may still be shutting down, or may have outlived a dead
+# herdr ("herdr already dead" above runs no gate at all). The purge asks the
+# adapter's own in-use verdict, the one the purge CLI uses, outside the
+# registry lock. Any answer but "free" (0) keeps everything.
+if [ "$PURGE" = "1" ] && [ -n "$PURGE_UUID" ]; then
+  inuse_rc=0
+  "$(_delegate_py_bin)" -m lib_py.agents in-use "$AGENT" "$PURGE_UUID" "$TARGET_CWD" --wait 5 >/dev/null || inuse_rc=$?
+  if [ "$inuse_rc" != "0" ]; then
+    echo "ERROR: conversation $PURGE_UUID is still held by a live agent process (rc=$inuse_rc)." >&2
+    echo "  Refusing purge — records preserved (no state was modified)." >&2
+    echo "  For claude, see the session files naming it under ~/.claude/sessions/." >&2
+    delegate_publish_event "$DELEGATE_JOB_ID" cancelled "purge aborted: conversation still in use; no state was modified" "$DELEGATE_JOB_TOKEN" "$DELEGATE_JOB_ATTEMPT"
+    exit 4
+  fi
+fi
+
 # INVARIANT: Terminal events for a job must be published AFTER atomic_dump_yaml updates the session status
 atomic_dump_yaml "$AGENT_SESSIONS_YAML" \
   SESSION_NAME="$SESSION_NAME" AGENT="$AGENT" PURGE="$PURGE" \