- check_agent() custom check_type: replace subprocess shell=True with
shlex.split + shell=False (prevents agent-registry config from injecting
arbitrary shell). Verified malicious '; touch' no longer executes.
- Add startup port guard in main: probe API port before uvicorn.run;
exit 1 with clear message if already bound (stops the double-instance
collision that caused phantom 'register does not persist' bugs).
- start_terminal_server (8082): pre-bind probe + try/except so a taken
port logs a warning instead of crashing the whole process.
e7d3710491