fix(sessions): export and verify delegate transcripts before cascading session deletion

[Drexuxux]

What?

hermes sessions export --delete-after-verified previously exported and verified only the explicitly selected parent session.

It then called SessionDB.delete_session(), which intentionally cascade-deletes every delegate/subagent session associated with that parent. This meant delegate messages and transcript files could be permanently deleted even though their content was never included in the verified archive.

Fix

The export flow now discovers the complete delegate deletion set and writes each affected session to a separate Markdown/QMD file.

Every generated file must pass the existing hash, session ID, and message-count verification before deletion begins. The expected deletion set is also checked inside the SQLite write transaction. If a new delegate appears while the export is running, deletion fails closed and all sessions are preserved.

Normal session deletion behavior remains unchanged.

Related Work

• feat(sessions): export sessions to Markdown/QMD #59542 introduced Markdown/QMD session export.
• feat(sessions): Markdown/QMD export, unified filters, and --redact on 'sessions export' #60186 merged the unified export surface and guarded --delete-after-verified flow.

These PRs introduced the affected workflow but do not handle delegate sessions that are cascade-deleted with their parent.

Tests

• Added real SQLite and filesystem E2E coverage proving both parent and delegate transcripts are exported before deletion.
• Added regression coverage proving a newly created delegate causes guarded deletion to preserve every session.
• Verified transcript cleanup still happens after successful export and verification.
• 497 passed
• Ruff passed.
• compileall passed.
• git diff --check passed.