Restrict session termination to support sessions only

- Persistent agents: No "End Session" menu, shows "Managed by Administrator"
- Persistent agents: Always reconnect, can only be removed via admin disconnect
- Support sessions: User can end via tray icon
- Tray icon still shows for persistent agents (status display only)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

agent/src/tray/mod.rs

@@ -36,18 +36,26 @@ pub struct TrayController {
 
 impl TrayController {
     /// Create a new tray controller
-    pub fn new(machine_name: &str, support_code: Option<&str>) -> Result<Self> {
+    /// `allow_end_session` - If true, show "End Session" menu item (only for support sessions)
+    pub fn new(machine_name: &str, support_code: Option<&str>, allow_end_session: bool) -> Result<Self> {
         // Create menu items
         let status_text = if let Some(code) = support_code {
             format!("Support Session: {}", code)
         } else {
-            "Connected".to_string()
+            "Persistent Agent".to_string()
         };
 
         let status_item = MenuItem::new(&status_text, false, None);
         let machine_item = MenuItem::new(format!("Machine: {}", machine_name), false, None);
         let separator = PredefinedMenuItem::separator();
-        let end_session_item = MenuItem::new("End Session", true, None);
+
+        // Only show "End Session" for support sessions
+        // Persistent agents can only be removed by admin
+        let end_session_item = if allow_end_session {
+            MenuItem::new("End Session", true, None)
+        } else {
+            MenuItem::new("Managed by Administrator", false, None)
+        };
 
         // Build menu
         let menu = Menu::new();