feature: let `session.archive` set where it writes, so a second Cortex can keep its own sessions

Read the session.archive configuration and cost_ledger.dir handling referenced in the issue, along with laptop-service.md; inspect how the archive chooses its directory and applies the local-install rule. Trace startup logging and the DELETE /v1/sessions loopback restriction. Done means an absolute dir overrides the default locally and enables archiving off a local install only when explicitly set with enabled: true, while existing retention and safety behavior remains intact.

Problem

The session archive always writes to ~/.cortex/sessions, and runs only when Cortex is started from a config inside ~/.cortex. There is no setting for the location.

That rules out keeping sessions on disk for any Cortex other than the one installed in ~/.cortex, for example:

• a second, side-by-side Cortex for development or experiments, run from a scratch directory next to your everyday one (the shape docs/evolve-plugin-e2e.md uses on ports 477xx);
• a demo or walkthrough that should keep everything it produces in one directory you can inspect and then delete.

Today such a Cortex keeps sessions in memory only. Restart it and every session is gone, including from agentop observe and the session API.

The only workaround I found is to start the second Cortex with HOME pointed at a scratch directory that contains its own .cortex/, holding a copy of the config and of the CA:

mkdir -p "$WALK/cortex-home/.cortex"
cp -R ~/.cortex/ca "$WALK/cortex-home/.cortex/ca"      # copies the CA private key
sed -e 's/127.0.0.1:4760\([0-9]\)/127.0.0.1:4770\1/g' \
    -e "s|$HOME/.cortex/ca|$WALK/cortex-home/.cortex/ca|" \
    ~/.cortex/config.yaml > "$WALK/cortex-home/.cortex/config.yaml"
HOME="$WALK/cortex-home" cortex --config "$WALK/cortex-home/.cortex/config.yaml"

It works: the archive is enabled, sessions survive a restart, and /v1/sessions?archived=true and agentop list them. But it has costs:

• The CA's private key is duplicated into a scratch directory.
• HOME moves more than the archive: the cost ledger, the plugin store and the price list move too, and anything else keyed on a local install changes with it (memory limit, bundled pricing).
• It's hard to explain in a walkthrough, and easy to get subtly wrong.

Proposal

Add a dir to session.archive, mirroring cost_ledger.dir:

session:
  archive:
    enabled: true
    dir: /absolute/path/to/sessions   # default ~/.cortex/sessions; a relative path is refused

Behaviour:

• dir must be absolute, refused otherwise with the same reasoning as cost_ledger.dir (a relative path depends on the working directory, not the config).
• Off a local install, the archive runs only when both enabled: true and dir are set. Without dir, the current rule stands, so a cluster still can't turn the archive on just by mounting a volume over ~/.cortex.
• On a local install, dir overrides the default location; everything else is unchanged.
• Retention, max_bytes and clearing behave as today. DELETE /v1/sessions keeps its loopback-only rule, so a non-loopback Cortex with an explicit dir still can't be cleared over the API, and the startup line keeps saying so.
• The startup log line already names the directory, so an operator can see where content is written.

Why this keeps the current safety reasoning

The existing docs (config.SessionArchiveConfig, laptop-service.md) explain why there is no dir: the archive stores raw prompts, completions and tool results, and on a cluster that needs a decision of its own rather than "a mounted path". This proposal keeps that: off a local install, nothing turns on unless someone writes both enabled: true and an explicit absolute dir, which is a decision rather than an accident of a mount. On a laptop, it only lets a user choose where their own history goes.

Alternatives considered

• Keep the HOME workaround. Works, but duplicates the CA key and moves unrelated state; see above.
• A --session-archive-dir flag. Same effect, but the archive's other settings are config, and a flag is invisible in the config a reader inspects.
• Save sessions on demand through the API (GET /v1/sessions/{id} to a file). Fine for one session, but loses restart survival, agentop's archived list and retention.

Open questions

• Should dir be allowed to point inside another Cortex's ~/.cortex, or refused to avoid two processes sharing one archive?
• Should the plugin store and cost ledger get the same treatment, so a side-by-side Cortex can be fully self-contained without touching HOME?

Context

Related: #1645 (running Cortex without touching the everyday install).

Found while writing a walkthrough that runs a dev Cortex with the evolve plugin next to an everyday install, and wanting its sessions to survive a restart for later inspection. Tested on Cortex evolve-plugin (ab08dda3, on main 8b0facd5), macOS arm64.