fix(fleet): consume model_hint + fix socket-default trap (#626)

Two spawn-side blockers found building the live PoC roster.

FIX 1 — model_hint not consumed: start-agent-session.sh built 'mosaic yolo
$RUNTIME' with no --model, so pi workers ignored the roster's model. Now
generateAgentEnv emits MOSAIC_AGENT_MODEL=<hint> and the launcher appends
${MOSAIC_AGENT_MODEL:+--model $MOSAIC_AGENT_MODEL} → workers run on e.g.
openai-codex/gpt-5.5:high.

FIX 2 — socket default trap: an ABSENT roster socket silently became
mosaic-factory in THREE places (parseRosterText fallback; the
mosaic-agent@.service Environment= default + ExecStop :-mosaic-factory;
start-agent-session :-mosaic-factory). The live PoC runs on the DEFAULT tmux
socket (socket_name absent). Now absent ⇒ '' ⇒ the literal default socket (no
-L) consistently across spawn, the systemd unit, fleet ps/watch observe, and
the onboarding cheat-sheet:
- socketArgs(name) → name ? ['-L', name] : []; replaces all ~15 -L sites in
  fleet.ts. parseRosterText fallback '' (was DEFAULT_SOCKET_NAME).
- shellEnvValue('') now emits a BARE 'VAR=' (not ''), so a socket-less .env can
  never yield a literal socket named "''" under systemd EnvironmentFile.
- start-agent-session.sh _tmux wrapper passes -L only when a socket is set;
  mosaic-agent@.service drops the socket default + uses a conditional ExecStop.

CONTAINMENT: all 6 shipped presets set socket_name: mosaic-factory explicitly,
so they are unaffected — only socket-less rosters (the PoC) get default-socket
behavior. DEFAULT_SOCKET_NAME exported as a constant for explicit isolation.

Verified: 158 fleet + 201 fleet-adjacent tests green (socketArgs none/named,
model_hint→env, explicit-socket renders -L, socket-less bare env); shell bash -n
+ end-to-end sim (socket-less→no -L, model→--model); tsc/eslint/prettier/
sanitize clean.

Refs #626

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EsgTQzV5YUGk1JtCLP4B83

docs/scratchpads/fleet-standup-fixes.md

@@ -0,0 +1,28 @@
+# Fleet stand-up fixes — model_hint→--model + socket-default trap (#626)
+
+- **Issue:** #626 · **Branch:** `feat/fleet-standup-fixes` (off main). PoC-blocking, before doctrine doc.
+
+## FIX 1 — model_hint consumed
+
+- generateAgentEnv emits `MOSAIC_AGENT_MODEL=<modelHint>` (bare empty when unset).
+- start-agent-session.sh default command → `mosaic yolo $RUNTIME ${MOSAIC_AGENT_MODEL:+--model $MOSAIC_AGENT_MODEL}`.
+  → pi workers launch with `--model openai-codex/gpt-5.5:high`.
+
+## FIX 2 — socket default trap (absent ⇒ literal default socket, no -L everywhere)
+
+- THE TRAP (3 sites): parseRosterText fallback was DEFAULT_SOCKET_NAME; systemd unit had
+  `Environment=MOSAIC_TMUX_SOCKET=mosaic-factory` + `ExecStop ${…:-mosaic-factory}`; start-agent-session
+  defaulted `:-mosaic-factory`. All fixed → absent socket = '' = default tmux socket (no -L).
+- `socketArgs(name)` helper → `name ? ['-L', name] : []`; replaced all ~15 -L render sites in fleet.ts.
+- shellEnvValue('') now emits a **bare** `VAR=` (not `''`) — unambiguous empty in systemd EnvironmentFile
+  (a quoted '' could become a literal socket named "''").
+- start-agent-session.sh: `_tmux` wrapper passes -L only when socket set; mosaic-agent@.service: dropped the
+  socket default + conditional ExecStop. So spawn == observe == onboarding cheat-sheet.
+- CONTAINMENT: all 6 shipped presets set socket_name: mosaic-factory explicitly → unaffected; only
+  socket-less rosters (the PoC) get default-socket behavior. DEFAULT_SOCKET_NAME exported for explicit use.
+
+## Verification
+
+- 158 fleet + 201 fleet-adjacent tests green; new: socketArgs none/named, model_hint→env, explicit-socket
+  renders -L, socket-less env bare. tsc/eslint/prettier/sanitize clean. Shell bash -n + end-to-end sim
+  (socket-less→no -L, model→--model).