feat: add session-tree navigation and branch-aware continuation - #33

Session history now groups fork archives beneath their source and provides a navigable entry tree and branch-tip selector. Selected entry and archive tip are distinct; preview follows only the selected parent chain. Resume and Fork from here carry that exact selection through IPC, and the main process checks Pi's loaded leaf before sending a prompt. The main process refreshes archive ownership and validates/reuses a single live runtime; repeated current-tip resume preserves its tab, and a running, mismatched, or unresponsive owner cannot silently become a competing writer. A reused runtime that switched archives refreshes its identity and transcript from verified state. Invalid/missing lineage, empty archives, stale selection, malformed records, and unavailable sources have explicit handling. Large entry lists and existing transcripts remain virtualized.

Pi 1.5.0 RPC exposes tree reads, fork, and clone, but no arbitrary-entry navigation command. Current-tip resume continues the original archive. Pi can append thinking/model metadata while opening an archive, so every fork is extracted before Pi starts; source bytes stay unchanged even during runtime startup. Historical continuation is labeled Resume in new fork. Forking writes a separate native v3 archive containing the selected chain, then opens it through supported --session. The runtime guard accepts only a verified linear chain of startup model/thinking entries after the selection and rejects unrelated movement. It preserves the original file and both source branches. ADR 0013 records the inspected runtime semantics and trade-offs.

Validation actually run (final head 3bce2eab0a0c738e589254fdc336e8679c11bacf; all GitHub checks pass and AO internal review is approved; this is not GitHub approval or merge authorization):

• mise run build: lint, all typechecks, 57 unit tests, 26 component tests, production bundle passed with pinned Node 22.23.0/Bun 1.3.14.
• bun run test:e2e under mise: all 26 deterministic Electron tests passed, including branch/ancestor selection, exact fork contents and prompt target, unchanged source bytes, current-tip resume, empty/stale selection, repeated resume with identical subprocess/tab count, active-owner rejection, failed owner-refresh refusal with unchanged bytes/PID, archive-switch identity/history replacement, normal archive-tree clicks at 1100×700, existing workbench behavior, streaming, and 4,500-entry transcript regressions. An earlier long-streaming timing timeout passed unchanged in isolation and on full reruns. The initial CI archive-list collapse is fixed with a reserved scrollable list; no forced clicks are used.
• Installed Pi 1.5.0 smoke: opened the actual forkArchive output and checked startup setup lineage through the implemented guard plus history through get_messages; only the selected branch appeared and source bytes were unchanged. No model prompt or tools executed.
• Screenshot/video proof: the branch tests capture selected-branch.png, selected-entry-fork.png, and session-tree-navigation.webm; CI uploads these in the pidex-e2e artifact under branch-proof/. Download uploaded screenshot/video proof. Local proof is also attached to AO session pidex-2. The recording includes a deliberate owner-refresh failure and its expected refusal to start another writer.
• AO Browser panel preview opened with deterministic temporary archives and the production renderer/parser. Interactive verification is pending panel visibility: AO reports BROWSER_PANEL_HIDDEN for human pointer input and ordinary input has not navigated the preview.

Known limits: continuation requires intact v3 archives within the existing 16 MiB browsing bound; older archives must be migrated in Pi. Archive extraction does not invoke extension fork hooks and previews show stored parent-chain history while Pi constructs its compacted runtime context. This adds no in-place historical navigation RPC. No live-provider inference was tested.

Refs #3 — first slice only. Last meaningful action / next-step recovery summaries and stale/blocked/done signals remain deferred, as do #4 cross-folder migration and #5 multi-root workflows. This PR intentionally does not close #3. No merge requested.