Support data-driven session agent identity in prompts

[leoncheng57]

Stacked on #176. Closes #52 (narrowed scope).

What

Data-driven agent identity for main-session prompts. A session driven by an arbitrary roster agent (e.g. one started in the TUI with a custom agent) is now promptable from the web UI with its own identity — previously a hard "continue in the TUI" dead end.

/sessions/ses_mock_agent_reviewer?directory=/tmp/mock-session-agents-project

Contract (each acceptance item from #52)

• Live roster, filtered: GET /api/session-agents returns the connected server's agents minus hidden internals and delegation-only (mode: "subagent") entries. Nothing is hardcoded.
• Identity preserved, never remapped: the prompt API gains an agent field, exclusive with mode. The named agent must equal the session's own driving agent (session record + latest user message); a different roster agent is a 409 SESSION_AGENT_MISMATCH. Nothing maps a foreign session to Build.
• No Plan/Build rules applied to other agents: the foreign path performs no policy activation and no session PATCH; the agent's configured policy plus any existing session ceiling governs the turn. Plan/Build must keep using mode (naming them via agent is a 400), so the policy-activating path cannot be bypassed.
• Model/variant defaults preserved: no overrides are sent unless the human picks one.
• Fails visibly when the agent disappears: a session whose agent left the roster gets 409 SESSION_AGENT_UNAVAILABLE before anything is sent, and the composer shows the reason with send disabled.

UI

• The composer shows a fixed identity chip (opencode-session-agent-fixed) for foreign sessions — mirroring the Managed Child chip — with a live-roster availability state. The Plan/Build toggle is unchanged for Plan/Build sessions.
• Unknown/conflicting identity stays unpromptable with the existing honest message.

Testing

• New tests/e2e/session-agents.spec.ts (owns its mock directory + fixtures per the shared-state ownership rule): catalogue filtering, foreign prompt with no policy patch, blend/remap refusals, vanished-agent failure, composer chip send, disabled composer honesty.
• Existing foreign-agent 409 guards for the mode path are unchanged and still pass.
• Full suite: typecheck, unit, build, 287 e2e.