Prepare privacy-gated remote session index

[andrei-hasna]

Summary

• add sessions-native remote index/privacy policy helpers for local SQLite, remote Postgres, and descriptor-only S3/AWS status
• add a redacted Postgres session_index_documents metadata index while keeping transcript/tool/embedding/feedback payload tables gated by explicit opt-in
• expose adapter/privacy diagnostics in storage status and document local-first runtime boundaries
• reconcile adversarial review findings: unknown tables fail closed, remote index uses remapped remote session ids, and configured RDS reports as enabled/writable

Validation

• env -i HOME="/home/hasna/.hasna/loops/worktrees/open-sessions/f74dcd64-2027-4c49-b8c4-552bf78a3d57-a4efcd63/.openloops/home" PATH="/home/hasna/.local/bin:/home/hasna/.bun/bin:/home/hasna/.local/bin:/home/hasna/.bun/bin:/home/hasna/.bun/bin:/home/hasna/.bun/bin:/home/hasna/.local/bin:/home/hasna/.local/share/fnm/node-versions/v22.22.2/installation/bin:/home/hasna/.bun/bin:/usr/local/cuda/bin:/opt/bin/:/home/hasna/.bun/install/global/node_modules/@hasna/codewith-linux-arm64/vendor/aarch64-unknown-linux-musl/codewith-path:/home/hasna/.codewith/tmp/arg0/codex-arg0k9S0ym:/home/hasna/.local/bin:/home/hasna/.bun/bin:/usr/local/bin:/usr/bin:/bin:/home/hasna/.claude/plugins/cache/claude-plugins-official/telegram/0.0.6/bin:/home/hasna/.cargo/bin:/home/hasna/.npm-global/bin:/home/hasna/bin:/opt/homebrew/bin:/usr/sbin:/sbin:/snap/bin" TMPDIR="/home/hasna/.hasna/loops/worktrees/open-sessions/f74dcd64-2027-4c49-b8c4-552bf78a3d57-a4efcd63/.openloops/tmp" TEMP="/home/hasna/.hasna/loops/worktrees/open-sessions/f74dcd64-2027-4c49-b8c4-552bf78a3d57-a4efcd63/.openloops/tmp" TMP="/home/hasna/.hasna/loops/worktrees/open-sessions/f74dcd64-2027-4c49-b8c4-552bf78a3d57-a4efcd63/.openloops/tmp" XDG_CACHE_HOME="/home/hasna/.hasna/loops/worktrees/open-sessions/f74dcd64-2027-4c49-b8c4-552bf78a3d57-a4efcd63/.openloops/bun-cache" BUN_INSTALL_CACHE_DIR="/home/hasna/.hasna/loops/worktrees/open-sessions/f74dcd64-2027-4c49-b8c4-552bf78a3d57-a4efcd63/.openloops/bun-cache" bun test test/storage-sync.test.ts test/storage-cli.test.ts test/no-cloud-boundary.test.ts test/mcp.test.ts test/mcp-http.test.ts test/search.test.ts test/semantic.test.ts -> 53 pass, 0 fail
• env -i ... bun run typecheck -> pass
• env -i ... bun test -> 160 pass, 0 fail
• env -i ... bun run build -> pass
• git diff --cached --check -> pass
• forbidden cloud marker search across guarded entrypoints -> no matches
• staged credential-value scan -> no matches

Notes

No production AWS/S3/RDS mutation, secret creation, deploy, data migration, or live upload was performed.