bug(session activity): waiting_input masks PR-derived status after worker opens a PR

[neversettle17-101]

Bug

A worker session can own an open PR while the session display still shows needs_input.

This happens when the session's last persisted activity signal is waiting_input. The read model derives status from durable activity plus PR facts, but waiting_input currently returns before PR facts are evaluated, so a stale activity state masks the PR pipeline state.

Source: local observation from current worker session
Reported by: @aditi1178
Analyzed against: f98c5e56cca246b9461552b938c5995a747551d8
Confidence: High

Reproduction

1. A worker reports activity.state = waiting_input.
2. The same worker raises/owns a PR, so ListPRFactsForSession returns at least one open PR.
3. List/get the session.
4. Actual: status remains needs_input.
5. Expected: session status reflects the PR pipeline (pr_open, review_pending, ci_failed, changes_requested, approved, mergeable, etc.).

Root Cause

deriveStatus prioritizes ActivityWaitingInput before PR facts:

if rec.Activity.State == domain.ActivityWaitingInput {
    return domain.StatusNeedsInput
}

open := openPRs(prs)
if len(open) > 0 {
    return aggregatePRStatus(open)
}

File: backend/internal/service/session/status.go.

So once a worker has a sticky waiting_input activity, PR attribution cannot change the display status. The current unit test in backend/internal/service/session/status_test.go codifies this behavior by expecting waiting_input + CI failing PR => needs_input; that expectation should change because PR facts are a newer, more actionable session signal.

Add/adjust tests:

• waiting_input + open PR => pr_open
• waiting_input + failing PR => ci_failed
• waiting_input + no PR => needs_input
• terminated sessions keep current precedence (terminated + merged PR => merged)

Impact

• Board/session UI shows a worker as needing input even after it has raised a PR.
• Activity appears stale because the display status is pinned to the last waiting_input hook.
• Orchestrator/user attention is routed to "answer the agent" instead of reviewing the PR state.