Forward the session scope ref when spawning a shared-scope conversation

[ReganBell]

POST /v1/conversations with a channel-or group-scoped capability created the session but started the seed turn without the shared scope's channelRef, so the turn was refused and the caller got a 202 with no runId while an orphaned empty conversation stayed behind. The route now parses the validated session scope and forwards its ref as channelRef for channel and group scopes; personal scopes are unchanged. A refused seed turn now discards the just-created session and returns 409 seed_turn_refused instead of persisting an empty conversation. Route-and store-level tests cover the member spawn succeeding and the refusal path cleaning up.

Deployment notes

No schema change; adds SessionStore.deleteSessionIfEmpty implemented in both memory and
pg stores (guarded DELETE, safe on old data)
pg acquireLease now refuses a lease unless the sessions row exists (INSERT ... WHERE EXISTS)
— any out-of-tree caller that acquired a lease before inserting the session would break; in-tree
callers create first
New pg_advisory_xact_lock serialization around lease/delete: during the blue-green window old
instances don't take the lock, so the empty-session-discard race protection is only partial until
the deploy completes (transient, worst case is the pre-fix behavior)
POST /v1/conversations behavior change: a refused seed turn now discards the just-created
empty session instead of leaving it persisted (this is the fix)

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}