feat(sessions): workspace binding — capture git remote/branch, group + filter, restore cwd on resume (#48190)

[professorpalmer]

Summary

Implements session ↔ workspace binding (closes #48190). Sessions already
recorded cwd; this adds git_remote + git_branch, derives a workspace
grouping key, surfaces it in sessions list, lets you filter by it, and
restores the recorded cwd on resume.

Incorporates the design refinement from the issue thread (@Ben-Home): grouping
is derived automatically from (cwd, git_remote) rather than user-organized,
and branch is a per-session attribute, not part of the grouping key — so
checking out a new branch doesn't fragment a workspace's session history.

What changed

hermes_state.py

• New git_remote / git_branch columns on sessions, added to SCHEMA_SQL
  so they auto-migrate via the existing declarative _reconcile_columns —
  no version-gated migration block, no breaking change.
• Best-effort git capture in create_session() derived from the cwd callers
  already pass (every frontend gets it for free; no call-site changes). Never
  fatal — any git failure yields NULL. Skipped for child sessions
  (subagents/compression) so worktree byproduct doesn't get a workspace identity.
• _normalize_git_remote() collapses SSH and HTTPS clones of the same repo to
  one key (github.com/owner/repo), credentials stripped.
• workspace_key(row) — grouping derivation: git remote first, cwd fallback,
  branch deliberately excluded from the key.
• list_sessions_rich(workspace=...) filter (matches remote exact/substring or cwd).

hermes_cli/main.py

• sessions list shows a Workspace column (repo@branch, — when unbound)
  and accepts --workspace <remote-or-dir>.
• Resume (chat -r / --continue) cds back into the session's recorded cwd;
  warns and stays put if the dir is gone (never fails the resume).

hermes_cli/_parser.py

• --no-restore-cwd flag on both chat parsers to opt out of cwd restore.

tests/test_session_workspace_binding.py

• 7 E2E tests against a temp HERMES_HOME (real SessionDB, real git repos,
  no mocks): column migration, git capture, SSH==HTTPS normalization, non-git
  cwd fallback, child-not-bound, --workspace filter, backwards-compat unbound.

Design constraints honored

• Cache-safe: workspace metadata is captured once at session creation and
  never mutated mid-conversation — no system-prompt churn, no per-turn token cost.
• Narrow waist: session-store + CLI surface only; no new model tool.
• Additive / backwards-compatible: pre-existing sessions have NULL
  workspace fields and render as unbound; sessions list falls back to the
  prior Preview column layout when nothing in the page is workspace-bound.

Test plan

HERMES_HOME=$(mktemp -d) python -m unittest tests.test_session_workspace_binding -v
# 7 passed

CLI smoke: hermes sessions list --help shows --workspace; hermes chat --help
shows --no-restore-cwd.

Not included (noted as follow-ups in #48190)

• Desktop GUI sidebar grouping (stretch) — backed by the same workspace_key.
• Worktree-per-session reattach (stretch).

Closes #48190