Demultiplex CLI approvals by authenticated session ownership

Multiple CLI or MCP connections may share one principal. Approval events are currently principal-scoped and do not expose a kernel-verifiable originating connection, so another same-principal session can observe and answer a request ID. Once Astrid exposes authenticated request ownership on approval events, route each prompt only to its owning session and require responses to match that owner. Do not bind ownership from payload-supplied principal or session fields.