fix(store): backfill session rows stamped with an empty tenant (RIG-4167)

[rigel-mintaka]

Fixes the existing data for RIG-4167. The writer was fixed in #1466.

Problem

Before #1466, a wake from the delivery loop ran under the system role and recorded agent_sessions and session_bindings with tenant_id ''. Those rows are still in the database. On mattfw, session_bindings has two '' rows. One of them belongs to an agent that is also bound in its real tenant. SessionBindingTenant therefore finds two tenants and refuses every ack for that session ("session bound in several tenants; refusing the runner call").

Change

Migration 0002_backfill_empty_tenant.sql runs as compass_system, because the owner is not a superuser, so FORCE RLS would hide the rows from it.

• agent_sessions and agent_placements take the agent's tenant (agent_accounts.tenant_id).
• agent_session_transcript_entries and agent_session_archive_segments take the tenant of their session.
• For each '' row in session_bindings:
  • If the agent's tenant holds no binding for that account or session, the row moves to that tenant.
  • Otherwise the row is deleted. It is stale; the live binding is the tenant-scoped one.

Migration numbering: compass-managed's #1375 also adds a 0002. Whichever lands second renumbers to 0003.

Tests

TestBackfillEmptyTenantMigration (store pgtest) seeds '' rows under the system role and replays the migration. It asserts that:

• no '' rows remain;
• a lone row is readable in the agent's tenant;
• the agent bound twice resolves to exactly one tenant, and its stale '' binding is gone.

Mutations:

• Without the NOT EXISTS guard, the migration fails on session_bindings_pkey.
• With the migration emptied, the test fails with "4 rows still carry tenant_id ''".

The store and server pgtest suites pass with -race. Lint is clean for the touched files.

[trunk-io]

😎 Merged successfully - details.

[linear-code]

RIG-4167

[github-actions]

Compass engineering docs preview: https://compass-server-rig-4167-back.compass-eng-docs.pages.dev

Deployed from compass-server/rig-4167-backfill-empty-tenant at 27a2d45.