persist_sessions: default off (opt-in until stress-tested)

Restart-survivable sessions change the core model (per-session holder
processes + SCM_RIGHTS fd passing). Keep them OFF by default so deploying
the build can't flip the daily driver's session model unproven; enable with
persist_sessions = true after stress-testing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/config.rs

@@ -52,7 +52,10 @@ pub struct ServerConfig {
     /// reattaching clients land on the same shell with screen state intact. When
     /// `false`, sessions behave exactly as before: the shell is a child of the
     /// server and dies with it.
-    #[serde(default = "default_true")]
+    // Opt-in for now: this changes the core session model (per-session holder
+    // processes + fd passing), so it stays OFF by default until it has been
+    // stress-tested on a real host. Set `persist_sessions = true` to enable.
+    #[serde(default)]
     pub persist_sessions: bool,
 }
 
@@ -84,7 +87,7 @@ impl Default for ServerConfig {
             allow_remote_non_loopback_bind: false,
             allow_agent_forwarding: false,
             accept_env: default_accept_env(),
-            persist_sessions: true,
+            persist_sessions: false,
         }
     }
 }