fix(usage): preserve project identity and qualify session counts

[avs-io]

Project summaries can split the same working directory across providers or attach a legacy pathless summary to the wrong project. Session totals can also look exact when the available history cannot establish unique session identities.

This preserves working-directory identity through discovery, parsing, caching and aggregation. It coalesces the same directory across providers, keeps distinct POSIX paths separate, preserves Windows path normalization, leaves ambiguous legacy summaries unallocated, and sums project savings correctly. Project details and charts use the same identities, including collision-safe rows and accessible full-path labels.

Counts now say “At least N” when history only supports a lower bound; unsupported per-session averages are omitted. Combined-device views show “Session count unavailable” when identities cannot be reconciled. The native menu uses the same count qualification and exposes project expansion as an accessible button.

Review order: this branch includes the two test-only prerequisite commits from #1270 because the existing process watchdog smoke test reproduced its startup race during verification. Please review/land #1270 first; I will remove those duplicate prerequisite commits when rebasing. The project/counting change is the separate f5fd47e8 commit.

Validation on current main (0b1cf56f) plus this change:

• CLI build and full suite: 3,856 passed, 5 skipped. Also rerun from an unbuilt source export after correcting a regression test that originally assumed dist/cli.js existed: 3,856 passed, 5 skipped. The test now spawns the source CLI with an isolated temporary fixture and preserves the same assertions.
• Desktop full suite with the test: stabilize process smoke and cache-lock regressions #1270 prerequisite: 864 passed, 4 skipped; typecheck and renderer build passed.
• Native focused count/payload tests: 8 passed across two suites.
• Independent adversarial source review, including comparison with the previously reviewed patch series.
• Personally exercised the freshly built renderer using actual CLI fixture outputs: ambiguous/case-distinct projects, independent expansion, keyboard collapse, provider filtering, and a legacy-to-current refresh without leftover rows. This uses an isolated read-only bridge, not the installed app's transport.

Related to #1260. No dependency or workflow changes.

Upgrade handling: invalidate render-5 status snapshots written before the count metadata existed, including same-version rebuilds. Daily/session accounting caches are retained. Independently reproduced the old-snapshot failure, verified the correction with the unchanged reproduction, and passed 50 focused/adjacent CLI tests covering empty zero, nonempty totals, carried historical accounting and subsequent warm snapshot reuse.

[iamtoruk]

Pushed df38e63 on top of the branch:

• spendProjectIdentity now folds Windows case like normalizeAbsProjectPathKey; cache C:\Work\Vault + live c:/work/vault was producing two payload rows
• overview projectAggKey uses the same helper, so POSIX case stays identity in the CLI table
• --json rows carry sessionCountBasis and drop avgCostPerSession when the basis is not exact; overview block gets the basis too
• deleted the five root-*.verify.test.ts scratch files (console.log, tautological asserts); ported the two uncovered assertions into existing suites
• renamed the codex-review-* tests, scrubbed REVISE markers, removed unused label helpers, Set in addSessionOnce, compact session label on the Windows and Mac project rows
  Root 3853 pass, tsc clean, app typecheck clean, swift build + SessionCountLabel tests pass, CI green.

[iamtoruk]

Identity, qualification, cache invalidation and privacy paths verified; patch df38e63 closes the Windows/overview identity gaps and the --json qualification. Merging.