fix(tmux): explicit transport-only dispatch and safe remote quoting (#1496)

tools/tmux/agent-send.test.sh

@@ -28,7 +28,7 @@ TOOL="$HERE/agent-send.sh"
 # Capture stub: stands in for send-message.sh. Decodes -b and prints the payload.
 STUB=$(mktemp)
 FAKE_BIN=$(mktemp -d)
-trap 'rm -f "$STUB"; rm -rf "$FAKE_BIN"' EXIT
+trap 'rm -f "$STUB"; rm -rf "$FAKE_BIN" "$SCRATCH_TMPDIR"' EXIT
 cat >"$STUB" <<'STUB_EOF'
 #!/usr/bin/env bash
 set -uo pipefail
@@ -62,9 +62,15 @@ no()   { FAIL=$((FAIL+1)); printf 'FAIL %s\n   %s\n' "$1" "$2"; }
 # Run the tool with the stub injected; echoes captured payload on stdout.
 run() { AGENT_SEND_SENDER="$STUB" bash "$TOOL" -S a:src -n dsthost "$@"; }
 # Hermetic auto-label runs: TMUX is controlled explicitly so results never
-# depend on whether the caller running this suite sits inside tmux.
+# depend on whether the caller running this suite sits inside tmux — and
+# TMUX_TMPDIR is pinned to an empty scratch dir so socket discovery never
+# sees the HOST's sockets (measured 2026-09-07: with default+mosaic-fleet
+# live, discovery saw the fake answer 'mos' on both and B1-refused rc 4
+# before the stub ever ran; a one-socket host passed, so this only bites
+# multi-socket hosts).
+SCRATCH_TMPDIR=$(mktemp -d)
 run_auto() {          # models a sender OUTSIDE tmux (no client context)
-  env -u MOSAIC_AGENT_NAME -u TMUX \
+  env -u MOSAIC_AGENT_NAME -u TMUX TMUX_TMPDIR="$SCRATCH_TMPDIR" \
     AGENT_SEND_SENDER="$STUB" PATH="$FAKE_BIN:$PATH" \
     bash "$TOOL" -n dsthost "$@"
 }