fix(update): the monitor is this workspace's exact command line; create/resume take the pane workspace's admission; refusal snapshots compare the registry by rows (Issue #72, review round 3)

- daemon.find_running matches `<bash> <reconcile.sh> --subscribe[ ...]`
  exactly instead of an unanchored, unescaped pgrep regex: another
  workspace's daemon (ws.a vs wsXa) or a process naming the path in an
  argument is no longer signalled by the update. update.sh re-checks which
  PIDs are still the monitor before SIGKILL.
- create and resume (spawn path) take the update admission of every
  installed workspace at or above the pane cwd, not only the control
  root's (lib.sh mam_update_admit_at, lib_py.update target-workspaces --cwd);
  the ~/.local/bin wrapper child drops all of them.
- tests: snapshot() skips the SQLite -wal/-shm and compares the DB by its
  rows (macOS keeps the sidecars and a read rewrites -shm); regression tests
  for the monitor match and for create/resume in another installed
  workspace (marker and lock wait); evidence line refs shifted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.agents/skills/lib.sh

@@ -3266,7 +3266,8 @@ mam_control_plane_prefix() {
 #
 # mam_update_admit [workspace [fd]]: rc 0 admitted (fd 7, or the given one,
 # held unless the workspace has no .mam), 1 refused (stderr). Delegate submit
-# also takes the workspaces its target is in on fds 20 and up.
+# also takes the workspaces its target is in on fds 20 and up, create and
+# resume those their pane's cwd is in (mam_update_admit_at).
 mam_update_admit() {
   local root="${1:-$WORKSPACE_ROOT}" fd="${2:-7}"
   local lock="$root/.mam/update-admission.lock" marker="$root/.mam/update-in-progress" st
@@ -3305,3 +3306,33 @@ mam_update_admit() {
 mam_update_admit_release() {
   eval "exec ${1:-7}>&-"
 }
+
+# mam_update_admit_at <cwd>: what create and resume take for an agent they
+# start in <cwd> - mam_update_admit for the control root (fd 7) and for every
+# other installed workspace at or above <cwd> (fds 20 and up), whose update
+# counts that agent (decision 1). rc 1 refused, nothing held.
+# mam_update_admit_release_all drops them all; a long-lived child started
+# while they are held runs it first.
+MAM_UPDATE_ADMIT_FDS=""
+mam_update_admit_at() {
+  local roots root fd=20
+  roots="$(PYTHONPATH="$SKILL_DIR:${PYTHONPATH:-}" "$(_delegate_py_bin)" -m lib_py.update target-workspaces \
+    --workspace "$WORKSPACE_ROOT" --cwd "$1")" \
+    || { echo "ERROR: cannot resolve the installed workspaces at or above $1" >&2; return 1; }
+  mam_update_admit || return 1
+  while IFS= read -r root; do
+    [ -n "$root" ] || continue
+    if ! mam_update_admit "$root" "$fd"; then
+      mam_update_admit_release_all
+      return 1
+    fi
+    MAM_UPDATE_ADMIT_FDS="$MAM_UPDATE_ADMIT_FDS $fd"; fd=$((fd + 1))
+  done <<< "$roots"
+}
+
+mam_update_admit_release_all() {
+  local fd
+  mam_update_admit_release
+  for fd in $MAM_UPDATE_ADMIT_FDS; do mam_update_admit_release "$fd"; done
+  MAM_UPDATE_ADMIT_FDS=""
+}