refactor(core): centralize session indexing

[xingkaixin]

Summary

• add a browser-safe canonical session index module for activity, route, agent, project, and project-agent lookups
• centralize route-keyed change/removal merging and stable activity ordering
• make the Web live-update and derived-index adapters reuse the canonical implementation
• keep CLI sorting on the same comparator and sorted-input fast path
• add characterization, deterministic incremental/full equivalence tests, and a reproducible benchmark

Why

Session ordering and lookup semantics were independently implemented in core orchestration, Web live updates, and Web indexes. That duplication made first-match route behavior, project identity keys, and SSE replacement semantics vulnerable to drift.

The new contract seam is pure and browser-safe, so both Node and Web adapters share behavior without sharing runtime-dependent instances.

Complexity note

The original O(K log N) target is not achievable end to end while CLI and React callers require complete array snapshots: materializing a snapshot has an O(N) lower bound. This change avoids sorting already ordered snapshots and centralizes the work, but does not claim a benchmark speedup. At 25,000 sessions and 100 changes, the median comparison was 27.46 ms for the canonical path versus 26.80 ms for the repeated-sort model.

A balanced incremental structure should only be introduced if callers can consume lazy ordered views; otherwise it adds implementation complexity without removing snapshot cost.

Validation

• pnpm lint
• pnpm format:check
• pnpm build
• pnpm test (654 passed)
• pnpm test:e2e (6 passed)
• pnpm bench:session-index

Closes CS-43