fix(session): exclude orphan org members from native pages

[ShiboSheng]

Problem

Fixes #803

The SDE sidebar could show only two normal sessions even when many more existed. Persisted Agent Org coordinator/member rows can keep org_member_id while using a normal native session type and a null parent. The standalone query excluded live Agent Org roots but did not exclude these membership-marked orphan rows, and the pinned-native query accepted them unconditionally. Because both queries applied LIMIT after those predicates, orphan rows consumed page capacity and displaced real SDE, OS, Human, or CLI sessions.

The authoritative source is agent_sessions, with live root identity supplied by agent_org_runs.root_session_id. Earlier UI/session pagination fixes did not cover stale coordinator rows whose run record no longer exists.

Solution

• Exclude every agent_sessions row with org_member_id from the standalone coding stream before keyset ordering and LIMIT.
• In the pinned-native stream, admit a membership-marked row only when a matching agent_org_runs.root_session_id proves it is a valid Agent Org root.
• Preserve valid coordinator roots and existing CLI/native merge order.
• Add boundary regression tests for first-page capacity, keyset pagination, pinned merge behavior, valid-root retention, and SQLite query-plan index use.

This is a read-path invariant fix. It does not change schemas, migrations, RPC/wire formats, writers, or persisted historical rows.

Potential risks

• A future standalone row that incorrectly sets org_member_id will be hidden from the standalone stream; that is intentional because the field denotes Agent Org membership.
• Valid coordinator roots depend on their agent_org_runs.root_session_id record. Regression tests cover retaining those roots in Agent Org and pinned views.
• Historical orphan rows remain in SQLite and are only excluded from native sidebar capacity; no destructive cleanup or migration is performed.
• The correlated root-membership probe adds a bounded indexed lookup. EXPLAIN QUERY PLAN verifies idx_agent_sessions_sidebar and idx_agent_org_runs_root_session are used.
• Rollback is a normal revert of this commit; there are no data-format or schema recovery steps.
• Automated packaged-app UI control was unavailable because the local Computer Use service failed to start three times. The exact BuildFast app was launched and inspected through database/process/log evidence, and the requester manually verified the sidebar behavior before authorizing this commit.

Verification

• cargo test -p agent_core core::session::persistence::sidebar::tests -- --nocapture — 5 passed, 0 failed.
• cargo test -p org2 pinned_native -- --nocapture — 2 passed, 0 failed.
• cargo fmt --all -- --check — passed.
• git diff --check — passed before commit; git diff --check origin/develop...HEAD passed after refreshing the PR base.
• cargo check -p agent_core -p org2 --all-targets — passed.
• cargo clippy -p agent_core -p org2 --all-targets -- -D warnings — passed; Cargo only reported the existing future-incompatibility note for dependency block v0.1.6.
• Read-only real database comparison — old query returned 10 rows containing only 2 normal sessions; fixed query returned 10 normal sessions. Current database had 0 pinned orphan rows.
• pnpm run tauri:build:fast — passed in 366.4s. Verified bundle: src-tauri/target/dev-build/bundle/macos/ORG2.app, version 1.2.5, SHA-256 20073f8826307d075aa70cc547b7ce633ad2b2352a40e5cb235a7b96e6f4c76b.
• Packaged-app process/log/database inspection — exact BuildFast bundle launched; no session/sidebar frontend errors and idle CPU sampled at 0.0%. Unrelated pre-existing worktree and Team Inbox warnings were observed.
• Manual acceptance — requester confirmed the rebuilt app shows the expected SDE session list and authorized commit/push/Draft PR.