Drop the no-op org_id pass-through params from vault/codex_provider/session dispatch

[chronoai-shining]

Summary

Remove the already-no-op org_id parameters threaded through the per-session env/provider resolution path. These params are passed but never read (each consumer ignores them via _), so this is a pure signature simplification with zero behaviour change — provider/codex.toml selection never depended on org_id. The internal worker protocol is already org-free (fkst-shared/src/protocol/types.rs and sessions/dispatch.rs carry no org_id), so this is wire-compatible with running workers and needs no /internal/v1/* change.

Depends on #272, which deletes SessionDoc.org_id (the source of the args these functions receive). May be merged into #272 if the team prefers a single session-area PR.

Problem / Motivation

• vault::list_for_scope takes _org_id: Option<&str> and ignores it; scope resolution is purely (owner_user_id, EnvScopeRef).
• codex_provider threads org_id into resolve_provider_choice → resolve_from_entries → ChronoLlmCheck::is_chrono_llm_connected, and every consumer ignores it.
• After Remove org_id from goal/session models, DTOs (OpenAPI), and the goal-issue marker #272 there is no SessionDoc.org_id to source these args from, so keeping the params would force passing a dangling None — better to delete them.

Proposed Solution — Implementation Spec

backend/fkst-control-plane/src/vault/service.rs

1. L176 list_for_scope(owner_user_id, _org_id: Option<&str>, scope) → drop the _org_id param. Update callers and the vault tests (the None org arg at the test call sites).

backend/fkst-control-plane/src/sessions/codex_provider/mod.rs

2. L104-108 trait ChronoLlmCheck::is_chrono_llm_connected: drop the org_id: Option<&str> param.
3. L122-128 AssumeConnected impl: drop the _org_id param (L125).
4. L144-153 resolve_provider_choice: drop org_id (L147) and stop forwarding it to vault.list_for_scope (L151) and resolve_from_entries (L152).
5. L160-177 resolve_from_entries: drop org_id (L163) and stop forwarding it to check.is_chrono_llm_connected (L171).

backend/fkst-control-plane/src/sessions/codex_provider/tests.rs

6. Drop the _org/None org arg from FakeCheck::is_chrono_llm_connected and every resolve_from_entries/resolve_provider_choice call. Assertions unchanged (RAW>STRUCTURED>DEFAULT precedence + the missing-chrono-llm 422 coverage are preserved).

backend/fkst-control-plane/src/sessions/service.rs

7. L2299-2301 resolve_env_profile: vault.list_for_scope(owner_user_id, session.org_id.as_deref(), &scope) → list_for_scope(owner_user_id, &scope).
8. L2331-2338 render_session_codex_config: drop session.org_id.as_deref() from codex_provider::resolve_provider_choice(...) (L2334).

(If #272 already changed L2300/L2334 to drop the org arg as part of its co-commit, this PR only removes the underlying params in vault/codex_provider; reconcile with the choice stated in #272.)

Scope Check

• ✅ In scope: the no-op org_id params in vault scope resolution + codex provider selection + their two call sites in service.rs.
• ❌ Out of scope / KEEP: the internal worker protocol (already org-free), dispatch.rs (no change), and all env-scope / provider-precedence behaviour.

Acceptance Criteria / Definition of Done

• list_for_scope, is_chrono_llm_connected, resolve_provider_choice, resolve_from_entries take no org_id.
• Provider-precedence and 422 tests pass unchanged.
• cargo test -p fkst-control-plane green; cargo build -p fkst-worker green (worker untouched, still compiles).