feat(agent-gui): add canonical session rail placement

[SingleMai]

What changed

• add a versioned canonical rail-placement value to AgentGUI session creation and shared-agent Host contracts
• persist the caller-selected kind, projectPath, and opaque sectionKey as immutable session data
• reject idempotent retries whose supplied placement differs from canonical state
• preserve placement across owner hosting and subsequent session reads
• keep placement optional for mixed-version clients; no pre-launch history backfill

Why

Shared-agent placement belongs to the caller's current user_project, not the owner's local project mapping. The persisted rail identity also lets project deletion retain current Tutti deleted-project semantics without relocating old sessions to Conversations.

Coordinated rollout

• tsh-server: https://github.com/tutti-lab/tsh-server/pull/483
• TSH: https://github.com/tutti-lab/tsh/pull/1973

This PR remains draft. After merge it needs a Tutti release; TSH must then upgrade all aligned Tutti dependencies and generated files atomically.

Verification

• pnpm generate:api (generated output clean)
• pnpm check:changed -- --push-ready (32 lanes passed)
• Host/store/service conformance covers same-key/different-project retry conflicts
• pre-commit formatting and repository boundary checks

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.