[Feature] Persist the Prime Agent app and build version in session journals

[sankks11]

Problem

Session journals identify their schema (version: 3) but do not identify the Prime Agent application build that wrote each record. This makes historical incident attribution unreliable after an update or daemon recovery.

In an audit of 25 top-level journals:

• prime-agent.update_restart records did not contain the old version, new version, or build identifier.
• update_complete records contained only the destination version.
• A later restart marker had no matching versioned completion in the audited journal set.
• Daemon/client logs were rotated and could not reliably bind an application version to a specific journal interval.

As a result, I could prove when a failure occurred but not whether that interval ran a particular Prime Agent release. The header's existing version field is a session schema version and must not be interpreted as the application version.

Proposed behavior

Persist optional provenance fields without changing the meaning of the existing schema field:

• appVersion on new session headers
• a build or commit identifier when available
• fromVersion, toVersion, and build identifier on update/restart records
• a fresh runtime-provenance record when a daemon adopts or resumes an older journal

Older journals and clients can ignore these optional fields. No private host, repository, or credential data is needed.

Why this matters

Reliable version provenance would make regression bounds, recovery analysis, and support reports materially more accurate. It would also prevent accidental claims that a historical failure occurred on the currently installed version.

Adjacent session-format context: #1409.