test(e2e): keep isolated server alive across agent execs

[pkyosx]

Summary

T-45 makes the isolated e2e station survive independent agent execs with an explicit, observable lifecycle carrier, and makes the unsupported member browser route fail clearly.

The root-cause evidence is a paired experiment run on the same machine and in the same launch exec: the ordinary nohup server on :8791 disappeared before the next independent exec (curl rc=7, PID gone), while the tmux server on :8793 returned real /api/version JSON and remained alive. This conclusion is deliberately limited to the observed Codex runtime; the exact killer/signal was not isolated, and the change does not claim tmux identifies that killer.

Changes

• Start each isolated server in a unique oc-e2e-* tmux socket/session and persist its exact identity.
• Validate the listener's git SHA and exact binary path before accepting health; teardown stops only the recorded private session/PIDs and protects production :7755.
• Close the setup TOCTOU window, reject stale or empty tmux state, centralize ambient environment scrubbing, and harden the regression guard with reachable mutants.
• Install and verify tmux in the macOS macos-e2e job before setup; the guard suite checks that this CI prerequisite remains wired before run_all.sh.
• Apply the owner decision that OffiCraft members use the isolated Playwright route, not cmux browser; explicit OC_E2E_BROWSER_BACKEND=cmux is rejected before setup with a named message, with README/CLAUDE guidance.
• Include the paired raw evidence and follow-up blocked-setup evidence in the branch.

Validation

• Rebased cleanly onto origin/main=4b4044109924896ac1653f425254294bdc018718; current PR head is 8d462353333fd02ad27a86e4c43771102a5b909c.
• On the fixed head, bash e2e_test/tests_guard/run.sh returned rc=0 with PASS=319 FAIL=0 and [tests_guard] all green; this includes the exact-call mutant and the CI tmux prerequisite guard.
• In a fresh isolated tmux setup on the rebased head, setup verified server identity git_sha=453a6401; the new tests/19_user_operation_contracts.spec.js ran in an independent exec with 3 passed (3.1s); exact teardown returned rc=0, released :8791, and left production :7755 untouched.
• Remote branch readback via both git ls-remote and GitHub API matched the PR head above; PR base readback is the rebased 4b404410.
• CI run 33466521887 on the prior head exposed the missing macOS tmux prerequisite: macos-e2e failed before setup could create anything. That was fixed in 8d462353; replacement CI run 33467596629 is the authoritative rerun for this head and completed success.
• The replacement run closed all 13 jobs on this head: 11 gate jobs succeeded (macos-e2e, frontend-ct, frontend-checks, go-checks, hygiene, e2e-isolation-guard, bin-guards, tcc-anchor, contract-guards, drift-checks, conformance) and the two conditional jobs (auto-beta, notify-main-red) were explicitly skipped; every returned job/check head_sha deduplicates to exactly 8d462353333fd02ad27a86e4c43771102a5b909c.
• Kyle's non-author review conclusion and its honest invalid-regex measurement are recorded in the task artifacts. That review read pre-rebase 243f90fc; a current-head follow-up review is requested after this rebase.

Known limits

• No full Playwright suite, full bin/ci.sh run, parallel execution, or load test was performed; the single new contract spec above was run as the targeted post-rebase check.
• The change does not claim to identify the process or signal that killed the ordinary background server, nor to fix cmux itself.
• The paired evidence establishes the observed behavior in this Codex runtime; it is not a universal claim about every executor's exec boundary.

Do not merge from this worker; final CI/accounting and land remain with Kyle.