[ShryukGrandhi]

Summary

pr_review_context falls back to SessionIDFromContext when no session_id param is given, but the value it picks is an overlay session that gets passed to the simulation. Since #649, overlay-scoped call sites are supposed to use OverlayCohortIDFromContext. Because this one didn't, a caller that sets X-Gortex-Overlay-Session got a simulation run against their own transport session's overlay instead of the cohort they asked for.

Changes

• Fall back to OverlayCohortIDFromContext(ctx) instead of SessionIDFromContext(ctx). When no cohort override is set, this returns the same value as before.
• Pass the resolved id to buildSimulation with WithOverlayCohortID instead of WithSessionID. buildSimulation reads OverlayCohortIDFromContext, so with the old code a cohort set on the context would still win over an explicit session_id param. Without a cohort set, behaviour is unchanged.
• Added TestPRReviewContext_SimulateUsesOverlayCohort. With a cohort set on the context it checks that the simulation uses the cohort and not the real session, and that an explicit session_id still takes precedence.

I also went through the other SessionIDFromContext consumers again (session/token stats, localization, agent registry, query log, diagnostics/health/readiness/stale-refs/graph-invalidated subscriptions, notes, tools_llm, tools_proxy). They all key per-session state rather than overlay scope, so I left them as they are.

Testing

• The new test fails on main (expected: \"pr-review-cohort\", actual: \"real-transport-session\") and passes with the fix
• go test -race ./internal/mcp -run 'TestPRReviewContext_|Simulat|Overlay|Cohort' passes
• go vet ./internal/mcp and gofmt -l are clean
• New tests added for new functionality
• Benchmarks run if performance-relevant (not relevant)

The full go test -race ./... suite was not run locally.

Checklist

• Code follows existing patterns in the codebase
• No unnecessary abstractions added

Fixes #708