Dead-man heartbeat (device only, while active)

Send every few seconds while the session is active OR paused; optional body {last_command_at, last_seq, task_running} extends the lease (last_seq must be an integer 0..2147483647, 422 otherwise, and only counts when it advances) (idle limit 2 min unattended, 5 supervised; an idle agent ends agent_idle). task_running: true says a whole task is running (many model turns and commands the server never sees); it extends the lease like a command, but only under a grant that carries device.task, and never past max_duration_s. 15 seconds of silence ends it with end_reason lost_contact. A 409 means the session is over and the device must stop.