fix(helix-org): record full agent transcript on activation stream

[philwinder]

Problem

The per-Worker activation stream (s-activations-<workerID>, surfaced by the worker_log tool and the live UI) only recorded high-level lifecycle markers:

=== activation: hire ===
=== exit: ok ===

The actual agent transcript — assistant text, tool_use, tool_result, errors — never appeared, making it impossible to drill into what a Worker's Claude/Zed agent actually did.

Root cause

Each activation opens a "live transcript bridge" that mirrors the agent's session WebSocket onto the activation stream. The org redesign (#2516) replaced the old client-method subscribe with a topic-based call that hardcoded an empty ownerID:

// spawner.go (before)
ch, err := SubscribeSessionUpdates(ctx, cfg.PubSub, cfg.Snapshotter, "", sessionID)

But the pub/sub topic embeds the owner:

func GetSessionQueue(ownerID, sessionID string) string {
    return "session-updates." + ownerID + "." + sessionID
}

Every publisher of agent traffic uses the real session owner (agent/observability.go, websocket_external_agent_sync.go, controller/sessions.go). So the bridge subscribed to session-updates..<id> — a topic nobody publishes to — and received zero frames. Only the markers the spawner publishes directly survived.

The browser WS handler (websocket_server_user.go) already gets this right and documents it: "The API always publishes to the session owner's queue ... must subscribe using the owner's ID, not their own."

Fix

• Add SessionOwner(ctx, sessionID) to SpawnerClient, implemented on inProcHelixClient via Store.GetSession (mirrors the browser handler).
• The transcript bridge resolves the owner once and subscribes to the owner's topic.
• The transcript test now publishes under a real owner (u-owner) on both sides, turning it into a genuine regression guard — it fails if the empty-owner bug returns.

Testing

• go build ./pkg/org/infrastructure/runtime/helix/ ./pkg/server/ — clean
• go test ./pkg/org/infrastructure/runtime/helix/ — all pass
• Verified the guard fails when the empty-owner subscribe is reintroduced.

🤖 Generated with Claude Code