fix(core): authorize session transcript export against the caller session (light-tested)

[1688mengdie]

Summary

The SessionHistory tool exported a session's persisted transcript
(optionally including tool inputs and thinking) without verifying that
the caller was allowed to read it. Any session could export transcripts
of unrelated sessions in the same workspace, and cross-workspace exports
resolved without an ownership check.

This PR adds a tool-level authorization gate for transcript exports.
The gate rejects callers outside the target session workspace outright,
then authorizes the export when the caller owns the workspace (a
top-level session with no creator), created the target session, or is an
ancestor/descendant of the target within the same session tree. Ancestor
chains are resolved from persisted session metadata with cycle
protection, and every path fails closed when no relationship can be
established.

Fixes #2604

Type and Areas

Type: security fix

Areas: Agent runtime / core

Verification

• cargo check --locked -p bitfun-core --jobs 4 — passed (0 errors, 0 warnings).
• cargo test --locked -p bitfun-core --features agent-runtime --lib read_authz --jobs 4 — 9 passed (new attacker-matrix suite: unrelated callers, owner bypass enabled/disabled, creator matches, both ancestry directions, sibling rejection, cross-workspace rejection, missing-metadata fail-closed).
• Full bitfun-core lib suite: 1495 passed, 1 pre-existing failure unrelated to this change (coordinator btw_session_persists_relationship_and_seeds_forked_listing_baselines, verified failing on the clean base commit via stash round-trip).

Reviewer Notes

• The gate is scoped to transcript export authorization; no tool surface or CLI behavior changes.
• Owner/creator/ancestry semantics mirror the data model already persisted in session metadata (created_by, relationship.parent_session_id); no new storage.
• Rollback is a revert of the two-file change (authorization module in session_control_tool.rs, wiring in session_history_tool.rs).

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable. (Not applicable: no user-facing change.)

This is an AI-assisted change.