fix(session): keep open findings when HEAD moves

[fiddur]

The blocker for reviewing your own change, found while wiring #16.

A session is identified by ref and HEAD hash together:

SELECT id FROM review_sessions WHERE ref = ? AND head_hash = ?

So the first commit after a review creates a new session and leaves every thread and walkthrough
behind in the old one — still in the database, invisible in the browser. That breaks the own-PR loop
exactly where it matters, because acting on a finding is what moves HEAD. It is also why the live
session on NCBackend3#14360 showed the walkthrough but none of the five findings: they were stranded
in an earlier session after gh pr checkout fast-forwarded the branch.

Open threads and walkthroughs are now moved into the new session. Moved rather than copied, so ids
stay stable and nothing duplicates. Resolved and dismissed threads stay behind — they belong to the
commit where they were dealt with, and reopening them on every later commit would be noise.

Tested end to end against a real repository: create a session, add an open finding, a resolved one
and a walkthrough, commit, and assert the open finding and the walkthrough follow while the resolved
one stays. vitest wired for the diffity CLI package, which had no tests.

Not done yet: line numbers are not re-anchored, so a thread whose code moved still points at the
line it was written against. anchor_content is already stored for exactly that, so re-anchoring is
the natural follow-up — and it matters more once findings survive commits.

Stacked on #16.

🤖 Generated with Claude Code

https://claude.ai/code/session_018PkYQzbsnMihHesafWvXKs