test(mcp): cover cwd privacy boundary in list_sessions

[eric-tramel]

Summary

Add an end-to-end regression test proving that list_sessions does not expose cwd-derived project metadata in either structured MCP output or rendered text.

This is follow-up coverage from #556. The production implementation merged there is privacy-safe, but its repository-level test injects origin_cwd, project, and originator as surplus mocked query-result columns that Serde discards. It does not seed a real cwd-bearing session/event or exercise the public MCP response path.

Acceptance criteria

• Seed a session/event fixture with a distinctive cwd such as /work/acme-secret-merger through the canonical input path.
• Invoke public AppState::list_sessions_v1 rather than serializing the repository DTO directly.
• Assert the structured MCP result omits the cwd marker and exposes neither originator nor project.
• Assert the rendered text output also omits the cwd marker.
• Keep the fallback label derived only from already exposed metadata: harness, mode, update time, and turn count.

Context

Follow-up to #556; no production behavior change is expected.