awaiting_input walked `children` to the deepest descendant, guessing that
the newest child is the foreground one. An agent that starts a background
helper and then blocks on read landed on the helper, so a session genuinely
waiting on the user was reported as idle.

tpgid in /proc/<pid>/stat is the kernel's own answer — the foreground
process group of the controlling terminal — and the group leader's pid is
the group id. One field read replaces a 64-deep walk.

Adds tests/activity.rs: the first end-to-end coverage of this pipeline,
which had none. The background-helper case fails against the old walk and
passes against tpgid.

Also makes the attach handler subscribe before upgrading. Checking
existence and then subscribing inside the callback left a window for the
liveness watcher to reap in between, which attach::serve compensated for
with a clean close; acquiring the subscription up front means the 404 and
the subscription are one step and the window does not exist.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

@@ -46,1 +38,3 @@
-    cur
+/// The process the terminal considers foreground.
+///
+/// `tpgid` is the kernel's own answer — the foreground process *group* of the

@@ -46,1 +38,3 @@
-    cur
+/// The process the terminal considers foreground.
+///
+/// `tpgid` is the kernel's own answer — the foreground process *group* of the

@@ -23,0 +47,4 @@
+/// `pgid` names a *group*, not a process. Its leader can exit while another
+/// member still holds the terminal — a foreground pipeline whose first stage
+/// finished — and then `/proc/<pgid>` does not exist. Members stay in this
+/// subtree because their parent shell is still alive, so they never reparent.

@@ -23,0 +55,4 @@
+fn foreground_members(pane_pid: i32, pgid: i32) -> Vec<i32> {
+    let in_subtree = subtree_members(pane_pid, pgid);
+    if !in_subtree.is_empty() {
+        return in_subtree;