fix(worker): keep-id compat, zombie tmux clients, nvm in box image

- Box init + chownInBox exec explicitly as root: under podman keep-id the
  container's default user is the mapped uid, which cannot useradd/chown.
- Init renames an existing uid-1000 passwd entry (podman keep-id injects one
  named after the HOST user) instead of adding a duplicate that would win the
  getpwuid lookup and make whoami report the wrong name.
- Terminal connections tag their shell with a per-connection marker and reap
  the process group on WebSocket close: closing the attach socket never
  killed the exec'd shell, so every disconnect leaked an attached tmux client
  (session stuck at the smallest zombie's size; enough dead clients starve
  tmux rendering for live ones).
- Job image: nvm 0.39.5 at /usr/local/nvm (user-writable) with
  /etc/profile.d/nvm.sh, matching what user dotfiles expect; docs for the box
  user + ownership model.

apps/agent-worker/tests/unit/box-user.test.ts

@@ -31,8 +31,14 @@ describe('buildBoxInitScript', () => {
     username: 'gabriel',
     home: '/home/Gabriel',
   });
-  it('creates the user idempotently with uid 1000 at the given home', () => {
-    expect(script).toContain("id -u 'gabriel'");
+  it('renames an existing uid-1000 entry instead of duplicating it', () => {
+    // podman --userns=keep-id injects a passwd entry named after the HOST user
+    // at the mapped uid; a second uid-1000 entry would win the getpwuid lookup
+    // and make whoami report the host username.
+    expect(script).toContain('getent passwd 1000');
+    expect(script).toContain("usermod -l 'gabriel'");
+  });
+  it('creates the user with uid 1000 at the given home when none exists', () => {
     expect(script).toContain('useradd');
     expect(script).toContain('-u 1000');
     expect(script).toContain("-d '/home/Gabriel'");