Add opt-in session modes while preserving shared defaults

[CBEPX]

Related proposal: #1173. Earlier session-isolation proposals #992 and #994 were closed as not planned.

Shared project state remains the default. PONYTAIL_SESSION_SCOPE=1 enables separate modes for Claude Code, Codex, OpenCode V2, and supported Grok hook adapters. Unsupported hosts, OpenCode V1, and missing IDs retain legacy behavior.

The store hashes the host, available project path, and stable session ID. Initialization preserves a concurrent explicit command. Mode writes publish complete files atomically. off persists like other modes. Default changes affect future snapshots only. A lifecycle event preserves the snapshot when the client preserves its ID.

The README documents manual cleanup, storage fallback, and the legacy UI limitation. This patch excludes Grok adapter installation, UI policy, marketplace changes, migration, and automatic garbage collection.

Validation applies to head 3710ffddc22aad9719e872a85896b581a87a8dac, which integrates upstream main 09c434ab73ca43761c5d8b0c5d341926c2fba710:

• Integrated candidate: 159 root tests and 30 pi tests passed. Clean upstream: 144 root tests and 30 pi tests passed in the same environment.
• Native qualification ran in order: Codex 0.163.0, Claude Code 2.1.301, OpenCode 2.0.30, Grok 1.0.60.
• All four clients kept A off and B full across resume and completed compaction. The checks inspect delivered hook output or native context fields, as well as stored state. Off sessions received no active rules after resume/compaction.
• OpenCode also tested process restart and changed defaults: existing snapshots stayed full; a new session used lite. Claude and Grok resume tests used new client processes. Codex reopened its thread within the same app-server process; a Codex process restart was not tested.
• Unit tests cover clear and default-snapshot behavior. Native /clear was not run; native default changes were tested only in OpenCode.
• An independent Claude Opus review found no blocking correctness defect in the upstream integration diff. A later evidence review identified gaps in the harness assertions; those assertions were strengthened and the native checks were repeated.

The Claude fixture adds only environment prefixes to hook commands for the isolated state directory and opt-in flags. The Grok fixture observes adapter stdout without changing the bytes sent to the client. Candidate hook scripts, matchers, and timeouts are preserved.

Upstream main changes hook definitions. Codex required approval of the new hook hashes in the isolated qualification profile. Existing installations may need to approve the hooks again through /hooks.

Windows-native qualification, the Band TSX suite, and native Band UI remain unverified. The legacy UI limitation still applies with session scope enabled.