fix(#707): scope session GC retention

packages/log/src/agent-logs.ts

@@ -58,9 +58,28 @@ export function createAgentLogsRepo(db: Db) {
       return rows[0];
     },
 
+    /**
+     * Transition hot logs for one session to warm tier. Session retention is
+     * default-deny: no other session's logs can be changed by this operation.
+     */
+    async promoteSessionToWarm(sessionId: string, olderThan: Date): Promise<number> {
+      const result = await db
+        .update(agentLogs)
+        .set({ tier: 'warm', summarizedAt: new Date() })
+        .where(
+          and(
+            eq(agentLogs.sessionId, sessionId),
+            eq(agentLogs.tier, 'hot'),
+            lt(agentLogs.createdAt, olderThan),
+          ),
+        )
+        .returning();
+      return result.length;
+    },
+
     /**
      * Transition hot logs older than the cutoff to warm tier.
-     * Returns the number of logs transitioned.
+     * Reserved for a separately authorized global retention job.
      */
     async promoteToWarm(olderThan: Date): Promise<number> {
       const result = await db