Add session reset CLI and telegram group allowlist guard

[Vardominator]

Summary

• add oco session reset to inspect and optionally clear local session indexes/jsonl files with backups
• add a Telegram plugin (telegram-group-allowlist-guard) that:
  • allows for securely adding bots to groups with non-allowlist users. agent can read messages and act based on whitelisted user but cannot reply or execute on behalf of non-allowlist user
  • allows group message ingestion/context updates
  • blocks group replies unless the latest triggering sender is allowlisted
  • blocks tool execution (before_tool_call) unless the latest triggering sender is allowlisted
  • strips/cancels leaked reasoning artifacts from outbound payloads (Reasoning: and <think...> tags)
• add focused test coverage for session reset behavior and Telegram guard decision matrix

Why

• provides a deterministic recovery path for stale/corrupted sessions without manual file edits
• enforces safer group behavior: non-allowlisted users can be read for context but cannot trigger actions
• prevents accidental reasoning-content leakage in user-visible replies

Validation

• bun test
• bun test tests/sessions.test.ts
• bun test tests/telegram-group-allowlist-guard.test.ts

Notes on scope

• intentionally not included: local override/inventory/org-specific working-tree edits (for example instances/*/config/instance.overrides*.json5, inventory/instances*.yaml local updates, and other local-only config tweaks)
• existing .gitignore already covers runtime/local override artifacts (instances/*/config/instance.overrides.json5, inventory/*.local.yaml, rendered configs/state/workspaces)