[refactor] session-flow: one renderer for migrate output, an enforced index lock, and one record of platform facts #1140

Follow-up to #1135. A review of that branch found four design problems that are not bugs today but make the next change to session-flow harder. They are listed here so they are not lost. None blocks #1135.

1. session migrate interleaves text and --json output

The migrate action in src/session-flow/session-cmd.ts is about 450 lines. Each exit point has its own text branch and --json branch (about 27 places check json). A new failure path has to remember both, and the "archive busy" message is already worded differently in the two modes.

Proposal: the action computes one result value (the WorkflowEnvelope data or error it already prints under --json), and one renderer prints it as text or JSON.

2. The session index lock rests on callers

SyncManager.saveSession and rebuildIndex are public and synchronous. The rule in docs/dev/agent-sessions.md says every save and rebuild runs inside withSessionIndexLock, but nothing enforces it: a new caller that forgets the lock compiles and works until two writes overlap.

Proposal: an async entry point on the archive that takes the lock, with the synchronous methods private to it.

3. MigrationEngine only previews

After #1135, MigrationEngine's only method is preview(session), which wraps fidelityFromSession in a DTO. The name says it migrates; copies go through AgentSession.copy.

Proposal: replace it with a preview function next to fidelityFromSession, or fold it into its one caller.

4. Facts about each platform are spread over several tables

Adding OpenCode in #1135 touched all of these:

• THINKING_SUPPORT, NATIVE_TOOLS, IMAGE_SUPPORT (src/session-flow/migrate.ts)
• DERIVED_WITHOUT_WORKSPACE and an OpenCode branch (src/session-flow/ids.ts)
• LISTED_THROUGH_SQLITE3, PLATFORM_OF_TOOL (src/session-flow/agent-session.ts)

A new adapter that misses one gets a wrong fidelity score or a wrong id without a failing test.

Proposal: one record of facts per platform, next to the adapter registry, that these tables read from. Then a test can check that every registered adapter declares each fact.

Related: #1135.