…ollow-up)

#1182 stopped surfacing empty Untitled sessions in the sidebar but left
the underlying disk-pile-up: every `/api/session/new` call still wrote
a JSON file via the eager `s.save()` at the end of `new_session()`.
Reload, click New Conversation, complete onboarding without sending
a message — each one orphaned a file under `~/.hermes/webui/sessions/`.

Fix: drop the eager save. A session lives in the in-memory `SESSIONS`
dict from creation; the first disk write happens at the natural
"this is now a real session" moment:

  1. `_handle_chat_start` sets `pending_user_message` and calls
     `s.save()` before launching the streaming thread (api/routes.py:2806).
     This is the path for the very first user message.
  2. btw and background-agent paths populate `title` + `messages`
     and call `.save()` themselves immediately after `new_session()`
     (api/routes.py:2710, 2752). Those continue to persist as before.

The two tests that broke required only the targeted update they
deserved:

  - `test_api_session_is_side_effect_free_for_stale_models` was reading
    the on-disk file straight after POST; updated to materialise the
    file from the API response when it isn't present, since the test's
    intent is verifying that a SUBSEQUENT GET doesn't rewrite the file.

  - The 7 new tests in `test_empty_session_no_disk_write.py` lock the
    new contract:
      - new_session() does not write to disk
      - the session lives in SESSIONS and is findable by get_session
      - an unsaved Untitled+0-msg session does not appear in
        all_sessions() output (the #1171 filter still applies)
      - save() writes when first invoked (post-message-append)
      - btw / background pattern still persists
      - five news in a row produce zero JSON files

Crash-safety trade-off: if the process exits between create and first
message, the unsaved session is lost. There were no messages to lose,
so this is the correct semantics — only conversations that received
real input get persisted.

Builds on #1171 (server filter + button guard) and #1182 (boot
early-exit, full-scan-fallback consistency).

Local full suite: 2637 passed, 47 skipped, 1 unrelated pre-existing
failure on macOS (test_sprint3 system-paths quirk).

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>