Let systemd track the tmux server it restarts

Type=forking with no PIDFile left MainPID=0, so systemd read a crashed tmux
server as a clean exit and Restart=on-failure never fired. tmux -D runs the
server in the foreground, which gives systemd the real pid.

-D also turns exit-empty off, so the synthetic orchestra-runtime session is no
longer needed to hold the server open past its last agent pane. Nothing else
in the tree referenced that session.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011xsXyr5J1RACo71YeKG3Pu

deploy/orchestra-tmux.service

@@ -22,21 +22,23 @@ Description=Orchestra tmux execution runtime
 After=network.target
 
 [Service]
-Type=forking
-User=orchestra
+# -D runs the server in the foreground, so systemd tracks the real server pid
+# as MainPID. Type=forking left MainPID=0, and systemd then read a crashed
+# server as a clean exit, which Restart=on-failure ignores.
+#
+# -D also turns exit-empty off, so the server outlives its last agent pane.
+# That removes the need for a synthetic idle session to hold it open.
+#
 # The socket name is the worker's tmux_socket for this harness (-L, not -S).
 # Keep the two in step; the worker does not create the server any more.
-#
-# The idle session exists so the server outlives its last agent pane. Without
-# it the runtime exits whenever a task completes, and the next launch spawns a
-# fresh server back inside whichever cgroup asked for it.
-ExecStart=/usr/bin/tmux -L orchestra new-session -d -s orchestra-runtime
-ExecStop=/usr/bin/tmux -L orchestra kill-server
+Type=simple
+User=kami
+ExecStart=/usr/bin/tmux -D -L orchestra
 # The runtime coming back empty is honest: the panes are gone either way, and
 # F16 observes that as real execution loss. Refusing to restart would instead
 # block every later launch until an operator noticed.
 Restart=on-failure
-RestartSec=5
+RestartSec=1
 
 [Install]
 WantedBy=multi-user.target