fix(reset): never take another live reset's fence, and fence absent row registries (#78)

Review round 4 (codex):
- R1: fence_registries reads an existing marker under the registry lock and
  refuses the reset, changing nothing, when another live (or undecidable)
  reset holds it - registries may be shared between workspaces; only a stale
  marker is replaced, and the reset's exit removes only its own fences.
- R2: the registries to fence come from update.jobs_dirs, the enumeration
  open_jobs now uses too, whether or not they exist; an absent row registry
  is created and fenced (a registration would create it), and one that cannot
  be created refuses the reset.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.agents/skills/multi-agent-mux-reset/scripts/reset.sh

@@ -150,12 +150,16 @@ fi
 fence_out=""
 fence_rc=0
 fence_out="$(MAM_STATE_JSON="$STATE_JSON" "$PY" -m lib_py.reset fence --workspace "$WS")" || fence_rc=$?
+fence_refusal=""
 while IFS= read -r line; do
-  [ -n "$line" ] && FENCED+=("$line")
+  case "$line" in
+    "fenced "*) FENCED+=("${line#fenced }") ;;
+    "refused "*) fence_refusal="${line#refused }" ;;
+  esac
 done <<< "$fence_out"
 if [ "$fence_rc" -ne 0 ]; then
   echo "ERROR: reset refused; nothing was changed:" >&2
-  echo "  - the job registries could not be fenced against new registrations (lib_py.reset fence rc $fence_rc)" >&2
+  echo "  - ${fence_refusal:-the job registries could not be fenced against new registrations (lib_py.reset fence rc $fence_rc)}" >&2
   exit 1
 fi