fix(chat): bind project ID through CLI chat + stage dispatch (issue #2)

Root cause: the 2026-09-28 controlled-projection hardening added the
ErrUnboundControlledProject guard, and the server path got session project
binding backfilled - but two paths missed:
- CLI chat mode never called session.SetProjectID (only -project name)
- coordinator handleAdvanceStage built StageRunRequest without
  ProjectID/UserID, so every stage-advance squad task was rejected

Fixes:
- handleChatMode gains projectID param (wired from -project-id flag);
  session binding follows the server convention
- handleAdvanceStage passes parseDecimalID(UserCtx.Project/User.ID)
- CLI chat tests get hermetic env (unreachable DB + ALLOW_IN_MEMORY) so
  local runs stop accidentally hitting the real dev DB on :5433
- stale test TestBindSessionProjectContext_KeepsExistingProjectID asserted
  the pre-fix 'switch does not propagate' bug; updated to assert switch
  propagation + bind no-overwrite

Result: go test -short ./... = 75 packages, 0 failures (first time).
Short tests promoted from report-only back into the required CI gate.

.github/workflows/ci.yml

@@ -42,38 +42,16 @@ jobs:
       - name: arch-check (block cleared kinds)
         run: ./scripts/arch-check.sh --mode block
 
+      - name: go test (short, required since 2026-09-29)
+        env:
+          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
+        run: go test -short -timeout 20m ./...
+
       - name: secrets scan (tracked files)
         run: |
           bad=$(git ls-files | grep -Ei '(^|/)(\.env|.*\.(pem|key|p12|sqlite|sqlite3))$' || true)
           if [ -n "$bad" ]; then echo "tracked secret-like files:"; echo "$bad"; exit 1; fi
 
-  short-tests-report:
-    # 存量已知失败（会话项目绑定等环境依赖用例）在 CI 从未通过；先报告不阻断，
-    # 跟踪 issue #2，修绿后并入 go-vet 必需门禁。
-    continue-on-error: true
-    runs-on: ubuntu-latest
-    services:
-      postgres:
-        image: pgvector/pgvector:pg16
-        env:
-          POSTGRES_USER: app
-          POSTGRES_PASSWORD: ci_secret_db_pass
-          POSTGRES_DB: agent_system_ci
-        options: >-
-          --health-cmd "pg_isready -U app -d agent_system_ci"
-          --health-interval 5s
-          --health-timeout 5s
-          --health-retries 20
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: "1.27.1"
-          cache-dependency-path: go.sum
-      - name: go test (short, report-only)
-        env:
-          TEST_DATABASE_URL: postgres://app:ci_secret_db_pass@postgres:5432/agent_system_ci?sslmode=disable
-        run: go test -short -timeout 20m ./...
 
   backup-restore-drill:
     runs-on: ubuntu-latest