stray-agent-check: flag daemon-hosted forks and claude procs missing the channels flag

stray-agent-check.sh v1.7 rule (iii) 'fork-session + bypassPermissions + NO controlling tty' never fires for daemon-hosted forks: bg-pty-host gives the fork a pty (2026-09-03: fork pid 1755269 = pts/55, reported 'no findings' while the agent was deaf to mail). Add two findings: (1) any claude process under 'claude daemon run' / bg-pty-host running --fork-session, regardless of tty; (2) any claude process with an llmmsg-srv MCP shim child whose argv lacks --dangerously-load-development-channels server:llmmsg-srv (compare against parent argv). Report-only stays; name the recovery command in the finding. Owner: bin-venus-cc (sh.git lane).