fix(agent-isolation): touch-overlay dismissals do not identify their signature precisely #1834

Follow-up to #1832. In both cases below, a touch-overlay dismissal does not identify its signature precisely.

1. A terminal and an agent session watching the same signature re-show a dismissed window.
When an agent session is armed while git signs from a terminal, two watchers track the same signature. The wrapped watcher (gpg.program / gpg.ssh.program set to the wrap shim) records its wrapper shell's pid as the signer. The hook watcher records the real gpg / ssh-keygen pid. dismissal_holds rejects a marker while a signer it doesn't name is running, so each watcher rejects the other's dismissal, and the window can come back for a signature that was already dismissed. The effect is extra windows only, never a missing one.

A possible fix: the wrapped watcher records its real signer child's pid as well as the wrapper's, so both watchers name the same signature. A two-watcher test covers it.

2. An ssh-authentication dismissal covers another ssh authentication within its minute.
An ssh authentication has no signer process, so its dismissal is an empty marker bounded only by DISMISS_TTL_MIN. Another ssh operation started within that minute (a second git push, say) gets no window, and waits on the key with nothing on screen. Before #1832 the same dismissal lasted until every session went idle.

A possible fix: clear an empty marker when the watcher sees the authentication end (the agent socket rows drop back). The cost is an extra window for another session's authentication if it is still waiting.

🤖 Generated with Claude Code