feat(swarm-worker): dispatch prose swarm slots to ephemeral Muse subagents

- daemon: route non-shell slot tasks to a fresh subagent session on dev/def/muse
  via muse_hybrid; add bin/ to sys.path so muse_hybrid/prompt_envelope import
  under the tmux supervisor
- prompt_envelope: add wrap_subagent_task() - plain task assignment without
  [TOOL tmux/swarm/cron] meta tags (subagents refused those as relayed test traffic)
- box-ctl/reporter: swarm-attach accepts optional session-id, stored as
  slot.subagent_session_id
- executor: _looks_like_shell requires an existing executable (prose like
  'verify ...' no longer misread as shell)
- poller: pick up pending swarms as well as running
- response-harvester: monitor running slot subagent sessions from swarms.json,
  allow '/' in RESULT/VERB job ids, archive ephemeral threads on any verdict
  (OK or FAIL), reap slot sessions for terminal swarms

bin/swarm_worker/executor.py

@@ -77,11 +77,19 @@ def _looks_like_shell(task_text):
         return False
     if _PROSE_RE.search(t):
         return False
-    # Must start with a word-ish token (not a quote or sentence).
+    # Must start with a plausible executable command or path
     first = t.split()[0] if t.split() else ""
     if not re.match(r"^[a-zA-Z0-9_.\-/]+$", first):
         return False
-    return True
+    # If it's a relative/absolute path, verify it exists and is executable
+    if "/" in first:
+        return os.path.isfile(first) and os.access(first, os.X_OK)
+    # If it's a bare command name, it must exist in standard system bin paths
+    for p in ("/bin", "/usr/bin", "/usr/local/bin"):
+        candidate = os.path.join(p, first)
+        if os.path.isfile(candidate) and os.access(candidate, os.X_OK):
+            return True
+    return False
 
 
 def _refused(task_text):