Linux hands port: reverse attach drops during long bash calls (same as #68) #70

Follow-up to #68 / #69, which fix the Swift client only.

poc/reverse-attach-linux/src/attach/client.rs still runs answer() inline in the read loop. While a tool call runs, nothing reads the socket, so the runtime's 20 s pings go unanswered and openab-pty closes the attach after more than three missed intervals (with openabdev/openab-pty#87: close code 4011, then a redial). A bash call longer than about 60–80 s on a Linux hands node therefore still fails the call.

The client already treats 4011 as redial (disposition_close falls through to Redial), so this is not a contract mismatch, just the same user-visible bug.

Fix options, as in #69:

• split the socket into a reader and a writer, answer each frame in its own task, and send replies through one writer;
• send a client keepalive ping every 15 s while attached (the runtime counts any inbound frame as alive);
• cancel a socket's in-flight calls when it ends, and kill the bash process group on cancellation.

Raised in review of #69 (finding O6).