feat(orchestrator): S5.3 agent states, Status menu and 3D faces

Every Agents view marks each agent as working, alive, sleeping, suspending, unreachable or dead with an animated symbol; a Status menu hides states and switches the 3D faces, kept through a reload. The hub's container sees neither ~/.claude/sessions nor host processes, so the host timer kvb-orchestrator-sessions.timer runs client/sessions.py every 15 seconds while the page polls: it reads the session records without following symlinks, only regular files up to 64 KiB, keeps name, status and statusUpdatedAt within type and length bounds, checks the pid's process start, and writes agent-sessions.json atomically. The hub ignores a snapshot that is missing, malformed, older than five minutes or dated in the future. make orchestrator-install enables the timer and orchestrator-check reports it.

🎯 Fix: 90 %
💥 Break: 5 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 86
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/orchestrator.sh

@@ -4,7 +4,7 @@
 #            write its .env, build and start the container, register the MCP
 #            server for Claude Code, build pkgmgr from the newest signed tag of
 #            PKGMGR_REPO and enable the tree timer and the cleanup path unit,
-#            enable the offices path unit; re-enable the runner and re-register
+#            enable the sessions timer and the offices path unit; re-enable the runner and re-register
 #            the hook when the migration took them over; an enabled runner gets
 #            the fresh unit and a restart
 #   migrate  move every trace of the earlier name to the kvb-orchestrator names
@@ -39,6 +39,7 @@ RUNNER="${NAME}-runner.service"
 TREE_UNIT="${NAME}-tree"
 CLEANUP_UNIT="${NAME}-cleanup"
 OFFICES_UNIT="${NAME}-offices"
+SESSIONS_UNIT="${NAME}-sessions"
 INSTALLED_SKILLS="${HOME}/.claude/skills"
 HOST_SCRIPTS=(kvb-org-organize/scripts/council.py kvb-org-organize/scripts/nofollow.py kvb-org-rasci/scripts/rasci.py)
 TREE_DIR="${HOME}/.local/state/pkgmgr/tree"
@@ -154,7 +155,7 @@ install_hub() {
 	cp -a "${REPO_ROOT}/orchestrator/." "${HUB}/"
 	# Python loads a cached .pyc whose header matches the source mtime and size, and cp -a keeps the mtime: one planted in the sandbox-writable tree would run on the host
 	find "${HUB}" -name __pycache__ -type d -prune -exec rm -rf {} +
-	chmod +x "${HUB}/client/permission_hook.py" "${HUB}/client/runner.py" "${HUB}/client/approval.py" "${HUB}/client/cleanup.py" "${HUB}/client/offices.py"
+	chmod +x "${HUB}/client/permission_hook.py" "${HUB}/client/runner.py" "${HUB}/client/approval.py" "${HUB}/client/cleanup.py" "${HUB}/client/offices.py" "${HUB}/client/sessions.py"
 	log "skills: the PermissionRequest hook client is ${HUB}/client/permission_hook.py"
 	log "skills: approvals need a pinned passkey: settings, 'Passkey registrieren', then 'make orchestrator-pin CREDENTIAL=<blob>'; until then every executor refuses"
 	printf 'KVB_ORCHESTRATOR_USER=%s:%s\nKVB_ORCHESTRATOR_STATE=%s\nKVB_ORCHESTRATOR_COUNCIL=%s\nKVB_ORCHESTRATOR_SKILLS=%s\nKVB_ORCHESTRATOR_PROJECTS=%s\nKVB_ORCHESTRATOR_TREE=%s\nKVB_ORCHESTRATOR_TIMERS=%s\nKVB_ORCHESTRATOR_APPROVERS=%s\n' \
@@ -230,6 +231,18 @@ tree_timer() {
 	log "skills: ${CLEANUP_UNIT}.path deletes the merged branches the operator signs in the Artifacts Tree, locally only"
 }
 
+sessions_timer() {
+	if ! has_systemd; then
+		warn "skills: no systemd user session; the agent states stay unknown."
+		return 0
+	fi
+	cp -f "${HUB}/systemd/${SESSIONS_UNIT}.service" "${HUB}/systemd/${SESSIONS_UNIT}.timer" "${UNITS}/"
+	systemctl --user daemon-reload
+	systemctl --user enable --now "${SESSIONS_UNIT}.timer"
+	systemctl --user restart "${SESSIONS_UNIT}.timer"
+	log "skills: ${SESSIONS_UNIT}.timer writes ${STATE}/agent-sessions.json every 15 seconds while the Agent Orchestrator page polls"
+}
+
 skills_current() {
 	local script
 	for script in "${HOST_SCRIPTS[@]}"; do
@@ -257,6 +270,7 @@ install_all() {
 	migrate || return 0
 	install_hub
 	tree_timer
+	sessions_timer
 	offices_unit
 	if ((TOOK_RUNNER)) || runner_enabled; then runner || true; fi
 	if ((TOOK_HOOK)); then
@@ -335,6 +349,11 @@ check() {
 	else
 		todo "${CLEANUP_UNIT}.path off: deleting merged branches from the Artifacts Tree waits for make orchestrator-install"
 	fi
+	if [[ "$(systemctl --user is-active "${SESSIONS_UNIT}.timer" 2>/dev/null || true)" == "active" ]]; then
+		ok "${SESSIONS_UNIT}.timer active"
+	else
+		todo "${SESSIONS_UNIT}.timer off: agent states wait for make orchestrator-install"
+	fi
 	if [[ "$(systemctl --user is-active "${OFFICES_UNIT}.path" 2>/dev/null || true)" == "active" ]]; then
 		ok "${OFFICES_UNIT}.path active"
 	else