feat: add multi-tenant session isolation

[Siddhant-K-code]

Description

Adds customer-level tenant tagging, cost attribution, reporting, subject-access export, and auditable erasure across flat and workspace trace stores.

Highlights

• Adds tenant_id to session metadata/events with watch --tenant-id and AGENT_STRACE_TENANT_ID propagation.
• Adds exact tenant filters to list and cost, plus tenant report, tenant export, and confirmed tenant delete commands.
• Includes tenant attributes in OTLP output and protects collector writes from tenant reassignment.
• Makes export/erasure complete across session sidecars, checkpoints, approvals, eval datasets, retention records, and all workspace stores.
• Adds durable tag/deletion journals, hash-only audit/tombstone records, immutable tenant assignment, cross-tenant tree protection, and fail-closed path/symlink validation.
• Preserves containment-safe legacy session/workspace IDs while keeping new ingress strict.
• Documents GDPR workflows and the collector boundary: one authenticated collector/storage root is one organization. Managed hosted infrastructure remains tracked by feat: hosted collector endpoint — managed agent-strace server with free tier #129.

Version and release

Bumps agent-strace from 0.89.0 to 0.90.0. After merge, the existing release workflow should create v0.90.0; the matching PyPI publish will be verified separately.

Verification

• Ona full suite: 1,814 Python tests passed.
• VS Code extension: 3 tests passed.
• Independent adversarial review completed; all findings were fixed and re-reviewed.
• git diff --check, compilation, CLI smoke tests, and README 300-line policy passed.

Closes #216

[Siddhant-K-code]

Independent review complete.

Reviewed the tenant boundary end to end: legacy storage compatibility, immutable assignment, collector ingress/read behavior, workspace enumeration, OTLP propagation, parent/child isolation, crash recovery, GDPR export/erasure completeness, external approval/dataset/retention records, hook-state attribution, and path/symlink containment.

The review reproduced and resolved the original high-risk edge cases, including hook filename traversal, outside-root checkpoint/audit access, omitted external records, post-audit rollback inconsistency, legacy event migration, and false-success discovery gaps. The final adversarial re-review approved the fixes with no remaining blockers.

Local CI-equivalent verification is green (1,814 Python tests and 3 extension tests). Merge remains gated on every hosted PR check completing successfully.