Expose compact sessions automation state

[andrei-hasna]

Summary

• Add compact default pages and detail flags for noisy human CLI surfaces: sessions list, history, watch --once, paths, recent, indexed-list, show, and graph.
• Add repo-owned agent automation APIs: sessions active-agents and sessions session-health, plus MCP tools/resources active_agents and session_health, and REST endpoints /active-agents, /session-health, /session-health/:id.
• Return stable bounded schemas with cwd/project path, command/resume command, agent/composer/activity classification, send/queue capability, issues, and raw evidence paths/refs instead of raw artifacts.
• Redact and bound variable strings in the new APIs, including titles, commands, paths, tmux errors, and resume metadata; compact one-line JSON is the default for these agent-first APIs.
• Add health-specific DB helpers for explicit prefix lookup status, real counts, and ordering by last indexed activity.
• Update README guidance and add regression coverage for compact defaults, MCP previews, HTTP endpoints, redaction, bounded payloads, lookup metadata, and invalid limits.

Agent-state API notes

• active-agents inspects tmux panes and reports recognized agent composers by default. Use --include-unknown to include shells/unknown panes and --no-capture when only command/cwd classification is needed.
• session-health returns compact indexed session state, activity/health classification, resume command when stable, bounded issues, and evidence refs such as sessions://session/... and transcript paths.
• The new APIs are read-only and idempotent; there is no apply path.

Compatibility notes

• Existing CLI --json defaults are preserved for the earlier compact-output commands unless an explicit new --limit is provided.
• MCP transcript/detail tools keep explicit full-detail escapes with include_full, message_limit, tool_call_limit, event_limit, and limit.
• New agent-first CLI/MCP/HTTP APIs intentionally use compact one-line JSON by default for token efficiency.

Adversarial review reconciliation

A read-only reviewer for this task flagged pretty JSON defaults, unredacted title leakage, unbounded string payloads, ambiguous ID lookup semantics, misleading totals, and non-health-oriented ordering. Reconciled by adding compact serializers for the new surfaces, redacted/bounded strings, lookup status metadata, real count queries, and last-activity ordering, with focused tests for the reviewed gaps.

Earlier compact-output review findings around MCP schema compatibility, unbounded sessions_read, inaccurate hints, and missing coverage were also reconciled on this branch.

Validation

• bun test
• bun run typecheck
• bun run build
• git diff --check
• staged secret scan before commit and before push
• live smoke: active-agents --limit 1 --no-capture and session-health --limit 1 both emit one-line JSON