Record which liveness source owns a session, instead of inferring it from the ref

[MJohnson459]

Record which liveness source owns a session

Reconciliation inferred the flavour of a refine round from the absence of a
session ref: no ref meant the interactive round, whose foreground pid genuinely
is the work. That could not tell a headless round whose ref capture timed out
apart from it, and for that one the pid is a --bg launcher dead within a
second — so the round was finalised failed while its agent went on rewriting
the body. The late-rewrite backstop corrects the marker afterwards, but not the
early exit from refining, which is what lets a second window hand a verdict to
a proposal whose body is about to be replaced.

Which source is authoritative is a property of the launch, so record it there:
sessions.liveness_source ('pid' | 'listing'), an additive column set by the
code that spawned the process. Dispatch and the headless refine record the
flavour of the agent's dispatch template — listing where the agent defines a
sessions verb, pid where it does not — and the interactive refine records pid,
being a foreground plan child. Reconciliation reads pid-authoritative sessions
by pid and listing-authoritative ones by listing, leaving a listing-authoritative
round with no ref unprobeable rather than guessed, exactly as a ref-less dispatch
already was.

Sessions open across the migration default to 'listing' — what every dispatch of
an agent with a sessions verb already was, and the direction that leaves a
session alone rather than finalising a live one.

DESIGN.md §5 gains the column (and the session_ref one it never recorded), §6
notes what each refine flavour records, and §8 states the rule that replaces the
ref-presence inference. Tests cover both flavours in voro-core and in
reconcile, including the headless round with no ref staying refining and the
interactive round still reconciling by pid under an agent with a listing.

Verified: cargo test --workspace, cargo clippy --workspace --all-targets -- -D warnings and cargo fmt --all clean; the migration applied to a copy of the
live database, which opened at user_version 17 with its open sessions defaulting
to 'listing' and none wrongly finalised.