feat(orgtrack): unify per-round session provenance

[VantaNode]

Summary

• make per-round session provenance a provider-neutral Orgtrack projection instead of ORG2/session-persistence-specific logic
• capture read, search, write, create, delete, rename, failures, modified files, line stats, commits, and pull requests
• reuse existing provider history loaders, then project normalized ActivityChunk data; no second transcript reader or raw transcript copy
• lazily backfill historical rounds into the versioned session_turns v10 read cache
• render localized per-round resource/edit metadata and keep whole-session modified-file filtering
• keep Session Blame and per-round metadata current without memory growing with indexed session count

Closes #387
Closes #388

Architecture

• orgtrack-protocol owns the stable action/outcome/envelope vocabulary
• orgtrack-core owns provider adapters, resource extraction, TurnMetadataAccumulator, paged store contracts, and development-artifact recognition
• session-persistence owns only the rebuildable SQLite read cache
• the app owns hook/process/filesystem/cloud-replay adapters and Tauri commands
• session_id, turn_id, actor_id, and provider thread_id remain distinct identities
• authorized cloud collaboration replay preserves exact owner attribution, remaps only provable checkout paths, and uses the same user-message round boundary

Existing provider readers remain the only transcript parsers. This leaves Orgtrack extractable later by changing Cargo dependency locations and supplying host adapters; the projection layer has no dependency on the ORG2 app crate.

Bounded freshness model

• Session Blame pages 30 root sessions by default (100 hard maximum); all child interactions stay with their root
• SQLite insert/delete triggers maintain the durable per-file revision across every writer and process restart
• payload-free Tauri invalidation events accelerate refresh; visible-only revision polling recovers missed events
• every hook-inbox consumer broadcasts after a successful drain, preventing a query from consuming an event before the drain loop can notify the UI
• historical backfill status/ownership/progress lives in SQLite; process memory retains only one owner UUID
• chat requests metadata only for visible turn IDs and explicitly removes atoms when those turns or the session unmount

Provider coverage

• Native ORG2: production event pipeline -> Orgtrack projector
• Managed live hooks: Claude Code, Codex, Cursor, Qwen Code, Factory Droid, Trae, OpenCode, Windsurf, Kimi, Antigravity, ZCode
• Lazy imported history: Claude Code, Codex, Cursor, OpenCode, Windsurf, WorkBuddy, Trae, Cline, Warp, ZCode
• Cloud collaboration replay: authorized local event cache -> checkout-safe path remap -> Orgtrack interaction store

UI behavior

Each round can show read/search paths, failures, modified/created/deleted/renamed files and line totals, commits/PRs, and an explicit no-file-change state. Whole-session modified files power basename/partial-path filtering without reparsing transcripts per keystroke.

Session Blame now incrementally refreshes an open file, supports bounded load-more paging, opens the independently replayable root/subagent transcript, and synchronizes that session to the matching sidebar group.

Verification

• cargo check
• Rust app tests: 936 passed
• orgtrack_core: 230 passed
• session_persistence: 21 passed
• scoped Clippy with -D warnings for changed crates (also rerun by pre-commit)
• npm run typecheck
• npm run lint
• frontend unit tests: 444 files / 5,127 tests
• isolated macOS Tauri/WebDriver Session Blame E2E using real Claude Code 2.1.210, Codex 0.144.1, and Cursor Agent 2026.07.09-a3815c0
• live hook invalidation/revision refresh while the file panel remains open
• distinct root/subagent transcript replay and Codex child sidebar expand/select/scroll
• isolated macOS Tauri/WebDriver per-round metadata scenario against the real command and SQLite cache
• all 13 session locale JSON files validated
• git diff --check

Audit reports:

• docs/architecture-audit-2026-07-15/session-file-metadata.md
• docs/frontend-ui-audit-2026-07-15/SessionFileMetadata.md

Submit checklist

• Existing provider parsers/loaders are reused.
• Historical indexing is lazy, durable, and non-destructive.
• Raw file content, query text, and tool output are not materialized.
• Runtime memory is bounded by visible pages/turns rather than historical session count.
• Cross-layer types, legacy DB migration, localization, cloud replay, and rendered UI are covered.