Persist sessions across server restarts via per-session holders

Make dosh terminal sessions survive a dosh-server restart
(crash/upgrade/systemctl restart): a reattaching client lands on the
SAME shell with screen state intact, instead of a fresh one.

Design: when persist_sessions is on (new config, default true) each
terminal session's shell runs in a small detached per-session holder
process (the dosh-server binary re-exec'd as `dosh-server hold`). The
holder double-forks + setsid into its own session, opens the PTY, spawns
the shell as ITS child, and serves the PTY master fd over a per-session
Unix socket via SCM_RIGHTS. The server adopts that fd to build a PtyHandle
that DETACHES (does not kill the shell) on drop, so a server exit leaves
holder + shell alive. On startup the server scans the runtime dir under
sessions_dir/run, reconnects to each live holder, receives the master fd
again, restores the persisted vt100 screen, and rebuilds the Session.

Screen/scrollback (server-memory only) is mirrored to disk atomically:
byte-throttled on the output hot path plus a 2s periodic flush, and
restored on re-adoption so reattach repaints. Truly-abandoned persistent
sessions are still reaped per the existing grace logic by asking the
holder to shut down. Anything in the persistent path failing degrades
gracefully to the original in-process shell.

PtyHandle gains an Owned (kill-on-drop, unchanged default) vs Adopted
(detach-on-drop) backing; resize on an adopted master uses TIOCSWINSZ.

No wire-format change, so protocol::VERSION stays 3. New deps: libc
(direct). New config: persist_sessions (default true); existing
integration tests pin it false to keep exercising the non-persistent
path unchanged.

Adds tests/integration_smoke.rs::session_survives_server_restart_same_
shell_and_screen: attaches, sets `cd /tmp; export MARK=...`, paints a
screen marker, KILLs the server, restarts it on the same config, reattaches
and asserts same shell pid + MARK + PWD + restored screen. Plus persist.rs
unit tests (name round-trip, screen save/load, dead-holder scan cleanup,
SCM_RIGHTS fd round-trip). cargo fmt --check and cargo test green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/config.rs

@@ -46,6 +46,14 @@ pub struct ServerConfig {
     pub allow_agent_forwarding: bool,
     #[serde(default = "default_accept_env")]
     pub accept_env: Vec<String>,
+    /// Run each terminal session's shell under a small per-session *holder*
+    /// process so it survives a `dosh-server` restart (crash/upgrade/
+    /// `systemctl restart`). On startup the server re-adopts live holders and
+    /// reattaching clients land on the same shell with screen state intact. When
+    /// `false`, sessions behave exactly as before: the shell is a child of the
+    /// server and dies with it.
+    #[serde(default = "default_true")]
+    pub persist_sessions: bool,
 }
 
 impl Default for ServerConfig {
@@ -76,6 +84,7 @@ impl Default for ServerConfig {
             allow_remote_non_loopback_bind: false,
             allow_agent_forwarding: false,
             accept_env: default_accept_env(),
+            persist_sessions: true,
         }
     }
 }