Decide headroom routing in the front door per session, not at launch #395

Whether a session goes through headroom is fixed when it launches: the launcher bakes x-agent-shim-headroom: 1 into the session's custom headers, and a launch with no provider, headroom or usage tracking never reaches the front door at all. A session cannot start using headroom later, stop using it, or be moved off it while the daemon is unwell.

The door already follows headroom's socket per request, so the missing piece is the per-session decision. It has to be made without clobbering Anthropic's prompt cache, which keys on the exact bytes of the prefix: headroom compresses the resent history deterministically each turn, so switching a session off headroom mid-session presents the original messages where the cached prefix holds compressed ones and rewrites the whole context. Switching on is cheap while headroom keeps the prefix frozen. A bypass on a transient reset is the worst case, so a session already using headroom keeps replaying through it, which the hop already does.

The design: every launch goes through the door, which decides once per session at its first request and changes the decision only at a cache boundary (the cache has expired, the context is small relative to what compression would save, or the session just compacted). The work is split into the sub-issues below.