Merge origin/main into soph/adopt-caller-guard

Three resolutions, two of them semantic rather than textual.

cmd/entire/cli/session/state.go: main split the listing into list(ctx, deleteStale) behind List and a new ListReadOnly, so that entire status can ask what is happening without reaping stale records; this branch added ListWithSkipped so callers that rank sessions against each other can tell "no sessions" from "we could not see them". Both survive — the private list now returns skips as well as states, List and ListReadOnly drop them, and ListWithSkipped reaps like List because its callers are List's. The loop body auto-merged correctly and needed no help.

CLAUDE.md: taken wholesale from main, which extracted it into a 199-line index with a 20 KiB budget enforced by go test ./docs/development. This branch had trimmed the same section by hand; main's restructure supersedes that. The one bullet that went stale is corrected rather than re-expanded — acting on a session now needs IsCaller() AND a candidate set known to be complete, which is a repository-wide contract and so belongs in the index, while the reasoning stays in the reference.

docs: this branch created docs/architecture/session-caller-resolution.md while main independently extracted the same material to docs/development/caller-session-resolution.md. Git saw no conflict because the paths differ, which would have left two accounts of one subsystem and a reference nothing links to. Main's path wins; the adopt-guard and store-completeness sections are spliced into it, replacing its "IsCaller() currently guards nothing, and that is the open half of this work" paragraph, which this branch is what closes. The orphan is deleted.

go.mod/go.sum: go mod tidy restored two direct requires (playwright-go, tailscale/hujson) that the previous merge of main had dropped. The result is byte-identical to origin/main.