feat(auth): propagate runtime session identity

[realmroot]

Summary

• read the raw runtime session ID from Codex, Claude Code, Copilot CLI, Goose, Hermes, and Pi environment variables
• add runtime and unchanged session_id to the signed private Agent binding claim
• omit both fields when the runtime exposes no session ID
• refresh cached Realmroot bootstrap credentials when the runtime session changes, preventing cross-session token reuse
• recognize runtimes directly from their session environment variables when their older marker is absent

Dependency

Merge and deploy realmroot/realmroot#222 first. The server change remains compatible with older CLIs.

Trust boundary

The runtime session is signed Agent-provided provenance for Resource Server correlation. It is not used for authorization or Agent identity selection.

Verification

• go test ./... (177 tests)
• go build ./...
• git diff --check

---

_{🤖 Created by Jarvis via Realmroot}