fix(browse): server runtime — restore off the boot path, shutdown that cannot hang, watchdog that still reaps tunnels

Four review findings on the wave's own new wiring: session restore ran
before Bun.serve with sequential 15s gotos while the CLI gives up at 8s
(one slow saved URL bricked every $B command) — restore now runs in the
background after bind; the shutdown snapshot gets a 2s deadline so a
wedged page.evaluate can't hold the port forever behind the new
ack-first stop; the persistence ticker gets in-flight + shutdown gates
and is cleared before the final snapshot; and the absorbed #2565
handoff fix no longer clears the whole parent watchdog — a suppress
flag keeps the tunnel-orphan reaper alive (handoff→resume→tunnel is no
longer an unreapable internet-exposed daemon). pair-agent with consent
off now names the real remedy instead of ngrok install instructions.
Lock-acquisition edge branches (garbage pidfile, vanish-race depth cap)
pinned.

browse/test/pair-agent-optin-gate.test.ts

@@ -95,6 +95,22 @@ describe('gate wiring — every tunnel activation point consults the guard', ()
     expect(CLI_SRC).toContain('const ngrokAvailable = pairEnabled && isNgrokAvailable();');
   });
 
+  test('CLI consent-off branch names the real remedy, never ngrok reinstall', () => {
+    // When pair_agent is off but ngrok is installed+authed, telling the user
+    // to `ngrok config add-authtoken` can never fix it — the gate is consent,
+    // not tooling. The consent branch must carry the same remedy wording as
+    // the /tunnel/start 403 body, and must not mention ngrok setup.
+    const branchAt = CLI_SRC.indexOf('} else if (!pairEnabled) {');
+    expect(branchAt).toBeGreaterThan(-1);
+    const branchEnd = CLI_SRC.indexOf('} else {', branchAt);
+    expect(branchEnd).toBeGreaterThan(branchAt);
+    const branch = CLI_SRC.slice(branchAt, branchEnd);
+    expect(branch).toContain('gstack-config set pair_agent on');
+    expect(branch).toContain('/pair-agent');
+    expect(branch).not.toContain('ngrok config add-authtoken');
+    expect(branch).not.toContain('install ngrok');
+  });
+
   test('/tunnel/start refuses with the enable hint when disabled', () => {
     const startIdx = SERVER_SRC.indexOf("url.pathname === '/tunnel/start'");
     const block = SERVER_SRC.slice(startIdx, startIdx + 1200);