feat(server): S3 box is for coding — OOM kills the command not the session, no tests from Claude, 4 AI sessions per member

- tool-run (CLAUDE_CODE_SHELL_PREFIX in member panes) runs each command
  Claude runs at oom_score_adj 1000 (session 300, Terminal tab 800,
  dashboard/tmux -100), so an OOM inside the capped unit kills the test
  run and tells Claude why, instead of killing the conversation.
- member-guard.js, a synchronous managed hook for ah-* accounts: denies
  test runners and container commands from Claude's Bash, and refuses
  the prompts of a session started by hand past MAX_AI_SESSIONS.
- ai-procs.js counts a member's top-level AI processes from /proc;
  spawnRun refuses a new pane past the limit (429 ESESSIONLIMIT).
Needs `agenthub server install-system` once, then a restart.

scripts/server/install-system.sh

@@ -16,6 +16,7 @@
 #   /opt/agenthub/libexec/member-hook       Claude hook forwarder for members
 #   /opt/agenthub/libexec/write-as          writes in a member's home AS the member (sudo -u)
 #   /opt/agenthub/libexec/pane-launch       starts a member's pane from its launch file
+#   /opt/agenthub/libexec/tool-run          wraps each command a member's Claude runs (OOM: it dies first)
 #   /opt/agenthub/libexec/tmux-member       a member's tmux, with their running server's own binary
 #   /etc/sudoers.d/agenthub       checked with visudo before it is installed
 #   /etc/claude-code/managed-settings.json  the member hooks (never over a foreign file)
@@ -107,6 +108,7 @@ chmod 0644 /etc/agenthub/server.conf
 install -m 0755 -o root -g root "$ROOT/scripts/server/agenthub-provision.sh" /opt/agenthub/sbin/agenthub-provision
 install -m 0755 -o root -g root "$ROOT/scripts/server/write-as.sh" /opt/agenthub/libexec/write-as
 install -m 0755 -o root -g root "$ROOT/scripts/server/pane-launch.sh" /opt/agenthub/libexec/pane-launch
+install -m 0755 -o root -g root "$ROOT/scripts/server/tool-run.sh" /opt/agenthub/libexec/tool-run
 install -m 0755 -o root -g root "$ROOT/scripts/server/tmux-member.sh" /opt/agenthub/libexec/tmux-member
 
 # ── node + the hook handler, for members (host-owned: the dashboard refreshes them) ──
@@ -164,7 +166,14 @@ else
     const hook = (e) => [{ ...(["PreToolUse","PostToolUse"].includes(e) ? { matcher: "*" } : {}),
       hooks: [{ type: "command", command: `/opt/agenthub/libexec/member-hook ${e}`, timeout: 5,
         ...(["PreToolUse","PostToolUse"].includes(e) ? { async: true } : {}) }] }];
-    process.stdout.write(JSON.stringify({ hooks: Object.fromEntries(ev.map((e) => [e, hook(e)])) }, null, 2) + "\n");
+    const hooks = Object.fromEntries(ev.map((e) => [e, hook(e)]));
+    // The guard is synchronous (it decides): no test runs or containers from
+    // Claude, and at most MAX_AI_SESSIONS AI sessions per member (member-guard.js).
+    const guard = (e) => ({ type: "command", timeout: 5,
+      command: `/opt/agenthub/tools/bin/node /opt/agenthub/app/scripts/member-guard.js ${e}` });
+    hooks.PreToolUse.push({ matcher: "Bash", hooks: [guard("PreToolUse")] });
+    hooks.UserPromptSubmit.push({ hooks: [guard("UserPromptSubmit")] });
+    process.stdout.write(JSON.stringify({ hooks }, null, 2) + "\n");
   ' >"$MANAGED"
   chmod 0644 "$MANAGED"
   sha256sum "$MANAGED" >"$MANAGED_MARK"