fix(cost): read usage only from scan-owned transcripts

[msapelov]

Summary

The live usage tracker reads unrelated session transcripts before deciding whether they belong to the current scan. Index session ownership first and replay only the parent and its discovered workers. Preserve partial-usage diagnostics for malformed token events.

Changes

• Read unrelated sessions only until their metadata identifies them, retaining incremental handling of partial metadata and delayed worker association.
• Keep indexed state until an initial replay succeeds so a transient read failure does not lose early usage or events. Replay newly associated workers from the start; allocate progress queues only when an observer consumes them and store compact identities for prose deduplication.
• Treat explicit null token measurements as unmeasured updates while keeping missing or malformed measurements visible as partial coverage.

Testing

• An actual filesystem-read probe on the parent read the full unrelated 256 KiB transcript; the regression now reads only metadata and does not reopen it.
• Complete cost suite: 79 passed, 215 assertions (seed 12345). The remaining four affected SDK suites passed in the focused run.
• Python saved-usage suite: 21 passed, two skipped. Valid, null, malformed, and missing token measurements were checked through actual scan completion.
• Types, formatting, build:ci, plugin bundle build, Ruff lint/format, portable source checks and nine compatibility tests passed.
• Full SDK runs passed with seeds 12345 and 84248915: 3603 passed, 53 platform skips, 70249 assertions each.
• Three independent native reviews and fresh verification passed.

Risk and rollout

Depends on #1276 and preserves that PR's usage callbacks and dashboard rendering. Directory enumeration continues; this change makes no constant-memory or timing guarantee. Existing polling intervals, prices, spending limits, and CLI syntax remain unchanged. Fixtures use synthetic local sessions.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.