feat(ctxmgr): wildcard session allowlist for semantic replace rollout
- SEMANTIC_SUMMARY_REPLACE_SESSIONS supports * (all sessions, present and
future), mirroring INTENT_PLAN_PROJECT_ALLOWLIST; empty allowlist still
replaces nothing (fail-closed defense in depth unchanged)
- declare SEMANTIC_SUMMARY_REPLACE(_SESSIONS) in dev/test/main compose app
env (stale Wave2 "REPLACE unwired" comment fixed); extend A-4 declaration
test; .env.example key docs updated
- sysadmin feature catalog: SESSIONS description + REPLACE reason note *
Prepares dev degraded-flags enable (task degraded-flags-enable-2026-09-26-r4):
user-authorized all-session replace, plan tier confirm, shadow summary, PI
change-report narrative; env ops and runtime verification follow.