feat(server-s3): a member's tmux follows tmux upgrades — tmux-member + Users → Members' tmux

A member's tmux server keeps the version it started with until their last
pane closes, but the dashboard asked it with TMUX_BIN, the newest tmux: a
3.8 client on a 3.6 server spun it at 100% CPU (three members needed a
manual kill on 2026-10-15).

- /opt/agenthub/libexec/tmux-member (install-system, in sudoers): runs a
  member's tmux call with the binary of THEIR running server
  (/proc/<pid>/exe, found from the socket in /proc/net/unix), else
  TMUX_BIN. It runs as the member and execs only a process they own.
  sudoArgv uses it once installed (linux-accounts readConf), TMUX_BIN
  until then.
- Users → Members' tmux (GET /api/users/tmux): each member server's version
  beside the installed one, sessions, agents working. An admin restarts one
  (POST /api/users/:id/tmux-restart) or every idle outdated one
  (POST /api/users/tmux-restart-idle), with their password again, audited
  per member; a server that will not stop answers 409 ETMUXSTUCK naming
  its pid for root.
- server-s3-system.test.js: `delete` is a provision action since Delete
  user, so the "unknown action" case now uses `purge`.

Operators: run `sudo agenthub server install-system` once.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/lib/tmux.js

@@ -720,6 +720,53 @@ function killSession(name) {
   noteSession(name, accountOfQuiet(name), false);
 }
 
+/**
+ * A member's tmux server as the Users page shows it: `{running: false}`, or
+ * `{running: true, version, pid, startedAt, sessions}`, or `{stuck: true}`
+ * when it did not answer (hung, or backed off). Asked with `tmux-member`, i.e.
+ * with that server's own binary.
+ */
+function memberServerInfo(acct) {
+  try {
+    const out = String(
+      memberCall(acct, [
+        "display-message",
+        "-p",
+        "#{version}\t#{pid}\t#{start_time}\t#{server_sessions}",
+      ])
+    ).trim();
+    const [version, pid, start, sessions] = out.split("\t");
+    return {
+      running: true,
+      version: version || null,
+      pid: /^\d+$/.test(pid) ? Number(pid) : null,
+      startedAt: /^\d+$/.test(start) ? Number(start) * 1000 : null,
+      sessions: /^\d+$/.test(sessions) ? Number(sessions) : null,
+    };
+  } catch (err) {
+    if (err.code === "ETMUXHUNG" || err.code === "ETIMEDOUT" || err.code === "ENOBUFS") {
+      return { running: true, stuck: true };
+    }
+    // "no server running" / "error connecting": nothing to report.
+    return { running: false };
+  }
+}
+
+/**
+ * Stop a member's tmux server — every pane of theirs ends (an admin's Users
+ * page action, so the next start runs the installed tmux). Throws when the
+ * server did not go: a stuck one may need root (`sudo kill <pid>`).
+ */
+function killMemberServer(acct) {
+  unreachable.delete(acct.login); // asked deliberately, past any back-off
+  try {
+    memberCall(acct, ["kill-server"]);
+  } finally {
+    listGen++;
+    listed.delete(acct.login);
+  }
+}
+
 /** Session names starting with `prefix`. Empty array if tmux has no server running at all. */
 function listSessions(prefix) {
   const names = [];
@@ -867,6 +914,8 @@ module.exports = {
   upgradeAdvice,
   serverPid,
   memberAttach,
+  memberServerInfo,
+  killMemberServer,
   __setExecImpl,
   __setAccountImpl,
   __settle,