fix(agent99): bound stale transport processes

apps/api/tests/test_agent99_transport_recovery_deploy_contract.py

@@ -98,3 +98,23 @@ def test_disk_pressure_policy_is_versioned_and_migrated_by_deployer() -> None:
     assert "$script:ConfigMigrations" in deploy
     assert '"policyVersion"' in deploy
     assert "toPolicyVersion = $sourceVersion" in deploy
+
+
+def test_agent99_bounds_stale_ssh_processes_without_touching_tunnels() -> None:
+    source = CONTROL.read_text(encoding="utf-8")
+    config = json.loads((ROOT / "agent99.config.99.example.json").read_text())
+    guard = source[source.index("function Invoke-AgentStaleSshProcessGuard") :]
+    guard = guard[: guard.index("function Send-AgentTelegramRelay")]
+
+    assert 'Get-CimInstance Win32_Process -Filter "Name=\'ssh.exe\'"' in guard
+    assert 'CommandLine -cmatch "(^|\\s)-[NLRD](\\s|$)"' in guard
+    assert "-not $portForward" in guard
+    assert 'CommandLine -match "BatchMode=yes"' in guard
+    assert "Stop-Process -Id $processInfo.ProcessId -Force" in guard
+    assert "taskkill.exe /PID $process.Id /T /F" in source
+    assert "-not $process.WaitForExit(2000) -and -not $process.HasExited" in source
+    assert config["sshProcessGuard"] == {
+        "enabled": True,
+        "staleMinutes": 15,
+        "hardStaleMinutes": 60,
+    }