pr_review_context uses SessionIDFromContext for an overlay session id, bypassing the cohort accessor

[zzet]

PR #649 split overlay-cohort identity out of the universal session identity: WithOverlayCohortID / OverlayCohortIDFromContext is the accessor every overlay-scoped call site is meant to use, while SessionIDFromContext stays the caller's real transport session for policy, token stats, notes, diagnostics and the rest.

internal/mcp/tools_pr_review_context.go:451 was missed by that sweep:

sessionID := strings.TrimSpace(req.GetString("session_id", ""))
if sessionID == "" {
    sessionID = SessionIDFromContext(ctx)
}

The value is explicitly an overlay session — the surrounding code feeds it to simulate_chain and the skip message reads "pass an explicit session_id (an overlay session)".

Consequence is small and in the safe direction: the fallback picks the caller's real session rather than the requested cohort, so a caller setting X-Gortex-Overlay-Session finds the review's simulation section reading the wrong (their own) overlay scope instead of the one they asked for. No cross-session exposure — the conservative identity is the one it lands on.

Fix is a one-line swap to OverlayCohortIDFromContext(ctx), which falls back to SessionIDFromContext when no cohort override is set, so the no-header behaviour is byte-identical.

Worth a quick audit of the other SessionIDFromContext consumers at the same time to confirm the remaining ones are all genuinely non-overlay. I walked them while reviewing #649 and they looked right (sessionFor, tokenStatsFor, agent registry, diagnostics / health / readiness / stale-refs subscriptions, query log, notes, tools_llm, tools_proxy), but a second pass on a file that already slipped through is cheap.