fix(tmux): bound calls on our own server and run them with the server's own binary

A tmux 3.8 installed under a running 3.6 server left PATH's 3.8 client
asking the 3.6 server, which spun at 100% CPU; the dashboard's
synchronous `has-session` on it had no limit and froze every page, hook
and terminal for five minutes (14:07–14:12 on the shared server).

- Every call on our own server now has a 5 s limit and the member's
  one-minute back-off (`host: tmux server not answering` meanwhile), so a
  stuck server costs the event loop one timeout per minute, not one per
  poll.
- Every call on a running server runs that server's own binary
  (`/proc/<pid>/exe`, found from its listening socket in /proc — asking
  tmux would be the very call that hangs), re-read every 10 s; PATH's
  tmux only starts a server or answers `-V`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/SERVER-MODE.md

@@ -675,6 +675,16 @@ a pane really is. Each case below is refused or bounded, with a test in
   click makes on a member's pane (start, type, stop) still waits, up to the
   3 s. Every other synchronous call
   that runs as a member (git in their folder, `write-as`) stops after 5 s.
+- **The host's own tmux server is bounded too.** Every call on it stops
+  after 5 s, and one that timed out is not asked again for a minute
+  (`host: tmux server not answering` meanwhile), so a spinning server can no
+  longer freeze the dashboard (it once did for five minutes). Every call on a
+  running host server uses that server's own binary (`/proc/<pid>/exe`, found
+  from its socket in `/proc`), so installing a newer tmux under a running
+  server no longer mixes versions: a 3.8 client asking a 3.6 server kept it at
+  100% CPU. A member's server is still asked with `TMUX_BIN` (the one path
+  sudoers allows), so after a tmux upgrade restart each member's tmux server
+  once it is idle (`sudo kill <pid>` of `tmux -S /srv/agenthub/users/<name>/.agenthub/tmux/sock`).
 - **A member's huge or sparse files.** Transcripts and journals are read line
   by line with a 64 MiB cap per line (a 512 MB line used to crash the server);
   a whole member file is read only up to a cap (1 MiB for a login or a