fix(sessions): collapse copied session files onto one entry per native id

[yexisu]

Problem

Session identity is stableId(path, header.id) — the file path participates in the hash. walkJsonl() collects every *.jsonl under the scan root recursively, so a copy of a session file (a backup, a manual copy) under any subdirectory became a second list entry for the same conversation (#1359). The scan only excludes symlinks, not content copies.

Fix

list() dedupes by the native header id after scanning: the newest write per native id wins, and stale duplicates are dropped from the records map so detail/search/prompt lookups cannot route to a dead copy.

Stable ids are intentionally unchanged (path still participates in the hash), so every persisted reference to an existing session id stays valid — only the duplicate listing is removed. The dedupe is bounded to the scan result, adds no I/O, and keeps the newest copy's data (it wins by updatedAt, which tracks the last entry timestamp).

Validation

• native-pi-session.test.ts 36/37 (new regression: a backup copy under a subdirectory collapses onto the original's id; the one failure, "never deletes a foreign publication", reproduces on pristine main and is unrelated baseline noise)
• agent-runtime tsc --noEmit clean apart from the same pre-existing baseline (modelSystem test fixtures)

Fixes #1359

[yexisu]

Rebased onto current main (c5a16e9aa, includes #1371/#1372) and force-pushed (2b98434a5). Native-pi-session suite: 36/37 on Windows — the one failure is the foreignPath.split("/") Windows path-separator baseline that #1370 fixes, unrelated to this change. Ready for a landing review.

[vastsa]

Thanks for the native-session deduplication fix. The duplicate-file issue is real, and the implementation preserves path-derived ids while selecting the newest transcript without mutating files. The storage and E2E contracts were added in #1374, which has merged; closing the original as superseded.