Closes #5783.

Summary

• Add protected session save modes for normal snapshots and intentional history rewrites.
• Reject stale controller snapshots that would overwrite a newer transcript already persisted on disk.
• Allow explicit rewrites (compact, rewind, cold-resume pruning, interrupted-turn/cancel recovery) only when the controller still owns the current on-disk transcript baseline.
• Let desktop session removal skip stale runtime snapshots while preserving the newer on-disk transcript for trash/removal flows.

Root cause

Normal controller snapshots rewrote the whole JSONL file. If an older tab/runtime still held a shorter in-memory session for the same session path, a later autosave or tab close could replace the newer JSONL with that stale snapshot, making messages appear to roll back or disappear.

Validation

• go test ./internal/agent ./internal/control
• cd desktop && go test .
• git diff --check
• go test ./internal/environment -run TestRunProbesUsesOverridePathAndFirstLine -count=1

Note: go test ./... was also attempted; the only failure was the same intermittent internal/environment probe timeout, and the focused probe test passed when rerun separately.