fix: create agent firewall sessions without requiring agent read access (#26990)

## Overview

Part of the **boundary correlation** feature. Fixes lazy creation of
`boundary_sessions` rows so it works within the agent's RBAC
constraints, and consumes the new `ConfinedProcessName` field reported
by boundary.

Pairs with coder/boundary#206, which adds `ConfinedProcessName` to
`ReportBoundaryLogsRequest`. This branch bumps the
`github.com/coder/boundary` module to pick up that work.

## Problem

`ensureSession` did a pre-insert existence check via
`GetBoundarySessionByID`. Agents are **not permitted to read boundary
sessions**, so that read path is not viable when the session is created
from an agent-reported log batch.

## Changes

- **Remove the pre-insert read.** `ensureSession` now inserts directly
and treats a primary-key unique violation as success, covering sessions
already created by a prior batch, a reconnection, or another coderd
replica — without requiring read access.
- **Per-connection guard.** Add a mutex-protected `ensuredSessions` set
so repeated log batches on the same connection skip the existence check
and insert entirely, touching the database only for the logs. On a
transient insert failure the session is left unmarked so the next batch
retries.
- **Consume `ConfinedProcessName`.** Pass `req.GetConfinedProcessName()`
through to the session insert.
- **Bump boundary module** from `v0.9.0` to
`v0.9.1-0.20260706095856-35ba90f9e8b2`.
- **Tests.**
- Add `TestReportBoundaryLogsAgentRBAC`
(`coderd/boundary_logs_test.go`), an integration test that connects as a
real workspace agent, verifies the session and log are persisted under
agent RBAC, and asserts the agent subject cannot read boundary sessions
— guarding against reintroducing a pre-insert read.
- Add `TestReportBoundaryLogsSessionGuard` (session inserted once across
two batches, logs inserted per batch) and
`TestReportBoundaryLogsSessionRetriedOnError` (insert retried after a
transient error).
- Regenerate `agent-firewall` CLI docs/golden files and adjust the
clidocgen template to render the YAML path when a flag has no long name.

> 🤖 This PR was opened by Coder Agents on behalf of @SasSwart.

enterprise/cli/testdata/coder_agent-firewall_--help.golden

@@ -23,6 +23,12 @@ OPTIONS:
       --disable-audit-logs bool, $DISABLE_AUDIT_LOGS
           Disable sending of audit logs to the workspace agent when set to true.
 
+      --enable-session-correlation bool, $BOUNDARY_SESSION_CORRELATION_ENABLED
+          Enable session correlation header injection. When no inject targets
+          are configured, the target is auto-derived from CODER_AGENT_URL (set
+          automatically inside Coder workspaces). Disable for deployments
+          without Coder AI Gateway in front.
+
       --jail-type string, $BOUNDARY_JAIL_TYPE (default: nsjail)
           Jail type to use for network isolation. Options: nsjail (default),
           landjail.
@@ -50,6 +56,15 @@ OPTIONS:
       --proxy-port int, $PROXY_PORT (default: 8080)
           Set a port for HTTP proxy.
 
+      --session-id-inject-target string, $BOUNDARY_SESSION_ID_INJECT_TARGET
+          Inject target for session correlation headers. Repeat the flag once
+          per target; each value describes exactly one target. Format:
+          "domain=<host> [path=<glob>]". Example: --session-id-inject-target
+          "domain=prod.coder.com path=/api/v2/aibridge/*".
+
+       string-array
+          Inject targets from config file (YAML only).
+
       --use-real-dns bool, $BOUNDARY_USE_REAL_DNS
           Use real DNS in the jail instead of the dummy DNS (allows DNS
           exfiltration). Default: false.