fix: attach_command from one builder; no kill/start_command; stop closes a row-less session (Issue #71)

- attach_command is `herdr --session <server> agent attach <herdr name>`
  (`default` written too), built by lib_py.agents.sanitize.attach_command;
  create, resume and reconcile all use it. kill_command and start_command
  are no longer written, and status --json drops start_command.
- The two raw kill-session hints (create exit 43, id_order's orphan) print a
  stop-skill command with --herdr-session instead.
- stop_session.sh closes a session that has no registry row, herdr only and
  without --agent, when herdr runs it inside this workspace; another
  workspace's session is refused (exit 5), a missing one is exit 1, one that
  survives kill-session is exit 6. The registry is not changed.
- Docs: only the SKILL.md lines these changes made wrong; the skill block
  pins follow. Tests that asserted the removed fields keep their intent
  (issue50: create's own row; issue21: no control-root path in
  attach_command; tier2: the new form and the absent fields). S11 pins the
  shim to 4243da5, which changed it on purpose.

Refs #71

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_issue50_pane_lock.py

@@ -170,7 +170,10 @@ def test_a1_create_replaces_the_monitors_registration_of_its_own_pane(mam_sandbo
     assert f"NOTE: the monitor registered {name} while it was being created" in res.stdout
     rows = [r for r in _rows(yaml_path) if r["name"] == name]
     assert len(rows) == 1 and rows[0]["status"] == "running" and rows[0]["role"] == "Creator"
-    assert rows[0].get("last_visible_note") != "auto-registered by monitor" and rows[0].get("start_command")
+    # create's own row: only create records how the claude id was chosen
+    # (the monitor's registration and the seeded row have no session_id_source)
+    assert rows[0].get("last_visible_note") != "auto-registered by monitor"
+    assert rows[0].get("session_id_source") in ("assigned", "pending-discovery")
 
 
 @pytest.mark.parametrize("kind", ["real", "old-adoption", "adoption-with-job", "other-server"])