fix(assistant): restrict native assistant tools to owned sessions #6217

What happened

Ordinary conversations receive the native personal-assistant tool catalog, including MatterDelegate, index management and initiative tools. A model in an ordinary conversation can create a durable hidden background task; its updates then resume the ordinary conversation as synthetic user input.

Expected: personal-assistant tools are available only to the assistant and its Host-owned workers or explicitly authorized long-task sessions. Ordinary conversations must neither discover nor invoke these tools.

How to reproduce

1. Enable the personal assistant and open a fresh ordinary conversation.
2. Ask it to carry out a concrete investigation or execution goal.
3. If the model selects MatterDelegate, a background Matter is created with the ordinary conversation as owner.
4. Task progress later enters that conversation through followup().

Confirmed against a running Desktop connected to a WSL Runtime Host: a normal conversation without assistant labels called MatterDelegate, and task notifications were persisted as role=user in that conversation. No personal-assistant entry was used.

Environment

• Surface: Desktop / WSL Runtime Host
• Current source base: 9826db1
• Native personal assistant enabled

Additional context

execution-composition.ts currently adds personalAssistant.tools unconditionally to both execution and tool-name discovery. Fix admission in the Host, retain assistant/worker capabilities, and reject stale tool handles from ordinary sessions as well as hiding their catalog entries.