fix(store): record which agent a decline was made for

[fajarhide]

passthrough_events recorded the command, the byte count and the reason, and no agent, so
OMNI could say what it handed back and never what share of it was handed back to a model
rather than to a shell. The ledger and the distillers exist to serve one of those two.

The obvious proxy is wrong, and this repository's own data disproves it. host output cap fires only when agent_id == "claude_code" (post_tool.rs:366), so every one of its
rows is a hook row, and 20 of its 39 carry no session id. An empty session is not a
door test.

What that was costing. #608 proposes changing the format-safety gate on the strength of
structured payload with no downstream reader. Re-measured today that pool is 12.33 MB over
576 calls, and splitting it by session id gives 11.99 MB with none against 0.34 MB with
one. If the session-less rows are pipe, the proposal is 36 times smaller than it reads. If
they are not, it is not. Nothing in the store could tell, so a gate change was queued
behind a number nobody could attribute, which is #760's shape exactly.

agent_id is written from normalized.agent_id on the hook path and from the resolved
agent on the pipe path, the same value distillations already stores.
passthrough_bytes_by_agent(days) reports the split. Rows written before the column read
unknown rather than being backfilled: the door cannot be recovered after the fact, and
guessing it is inventing the number this exists to stop inventing.

The first test I wrote was toothless, and the break step found it. It called
record_passthrough with the agent passed in by hand, so blanking the agent at every
post_tool call site left it green. The test runs through process_payload now, and the
same break is red:

assertion `left == right` failed: the hook has to record the agent it resolved, not a
default: [("unknown", 1, 1111)]

That is the third test this session that passed for the wrong reason and was caught by
breaking it rather than by reading it.

Verification: make ci green, smoke_test.sh 70/70.

Closes #773

Greptile Summary

The PR adds durable agent attribution to passthrough events and exposes per-agent byte aggregation.

• Migrates existing SQLite stores with an agent_id column whose legacy rows remain unknown.
• Records resolved agent identity for hook declines and pipe passthroughs.
• Adds regression and aggregation coverage for the new attribution.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported decline-attribution defect is fixed across the current hook recording paths.

Important Files Changed

Filename	Overview
src/hooks/post_tool.rs	All hook passthrough-recording paths now use the same resolved reporting identity used by distillation, resolving the prior misattribution.
src/hooks/pipe.rs	Pipe passthrough paths now persist the resolved pipe agent identity.
src/store/sqlite.rs	Adds backward-compatible agent attribution storage and a parameterized per-agent aggregation query.
changelog.d/773.fixed.md	Documents the new attribution field, query, and intentional treatment of legacy rows.

_{Reviews (2): Last reviewed commit: "test(hooks): say what the Codex arm does..." | Re-trigger Greptile}

Context used (3)

• Knowledge Base — Tool hook integration
• Knowledge Base — Persistent data and retrieval
• Knowledge Base — Restore accounting for declined payloads