fix(sessions): read fast-path falls through to the in-process engine when the standalone is missing (PHNX-4012 follow-up)

[muqsitnawaz]

Problem

Since #3554 the agents sessions read fast-path (cli/src/index.ts) execs @phnx-labs/sessions-cli for search/list/id lookups and, when that binary is missing, refuses:

The standalone `sessions` CLI is not installed.
Install it, then re-run this command:
  npm i -g @phnx-labs/sessions-cli

@phnx-labs/sessions-cli is not on npm (E404), so every fleet worker and every CI runner is such a box. Main's attestation suite is red since 7c68224 on sessions.cli-list.test.ts and sessions.fleet-json.test.ts (both plain sessions --json --no-interactive queries), which #3554's scoped PR test job never ran; attestation runs the full suite. That blocks every release, including 1.22.91 (#3553).

Change

A missing standalone (SESSIONS_BIN_MISSING) falls through to the in-repo engine, with a one-line stderr hint (AGENTS_SESSIONS_FASTPATH_HINT=0 silences it). A box with sessions installed still takes the fast path; other resolver errors still throw. No change to sessions-client.ts or its tests.

Verification

Locally with PATH stripped of every sessions: index.sessions-fastpath.test.ts (new fall-through case on the shared fixture), sessions.cli-list.test.ts, sessions.fleet-json.test.ts, sessions-client.test.ts: 23 passed. tsc --noEmit clean. By hand, bun src/index.ts sessions --json --no-interactive under a bare HOME now reaches the engine (agents-cli is not set up. Run: agents setup) instead of the refusal.

Alternative for the feature owner: publish sessions-cli and install a pinned version in tests/global-setup.ts the way secrets-standalone.ts does; the fall-through stays useful either way for boxes without it.

Tracking: PHNX-4012, PHNX-3940.

[muqsitnawaz]

VERDICT: APPROVE

Non-author review (code-reviewer subagent, two passes). Pass 1 traced the fall-through: bin stays null only on SESSIONS_BIN_MISSING, every other resolver error still throws, the null path reaches bootstrap.js, the hint is stderr-only and no sessions test asserts exact stderr; the new test's PATH filter is deterministic on all three CI platforms; the hard fail was defensible in isolation but not with the package unpublished, and installing it in tests/global-setup.ts is impossible today. One blocker: the sessions-client.ts header still asserted 'no fallback on the read path'. Pass 2 verified 0d76c91 fixes the docblock; only a comment changed.

Checks: the four sessions files 23/23, tsc clean, CI Tests green on ca46307 (docblock-only commit re-running).