Replace session/kernel/agent ORM relationship usages with explicit queries and remove them

Replace every remaining usage of the session, kernel and agent ORM relationships with explicit queries through the repository/ops layer, then remove the relationship definitions and the loader options that depend on them.

### Target relationships

- SessionRow.kernels, SessionRow.user, SessionRow.group
- KernelRow.session, KernelRow.agent_row, KernelRow.image_row, KernelRow.user_row, KernelRow.group_row
- AgentRow.agent_resource_rows, together with the second-level AgentResourceRow.slot_type_row chain it is always loaded with

SessionRow.kernels and KernelRow.session are a back_populates pair and must be removed together. None of the target relationships declare cascade or passive_deletes, so delete behaviour is driven by database foreign keys and is unaffected by the removal.

### Scope

- Row helpers built on the relationships are the bulk of the work: SessionRow.main_kernel (roughly 130 call sites across registry, session service, sokovan and bgtask), AgentRow.actual_occupied_slots, SessionRow.delegate_ownership, SessionRow.resource_opts and SessionRow.get_kernel_by_id. Converge them onto the dataclass-based accessor pattern already used by the sokovan lifecycle view.
- gql_legacy is in scope. The session, kernel, agent and schema modules under gql_legacy are the largest single consumer and are converted in this story rather than deferred to the gql_legacy removal.
- Filtered eager loads such as selectinload(SessionRow.kernels.and_(KernelRow.cluster_role == DEFAULT_ROLE)) have no drop-in replacement. Replace them with explicit queries plus batched assembly so the conversion does not introduce N+1 queries.
- Remove the relationship definitions and every dependent loader option: roughly 53 selectinload/joinedload sites across the repositories, models, registry, gql_legacy and tests. The noload("\*") guards that exist only to stop relationship cascades disappear along with them.

JIRA Issue: BA-7226

Start with the Row helpers SessionRow.main_kernel, AgentRow.actual_occupied_slots, SessionRow.delegate_ownership, SessionRow.resource_opts, and SessionRow.get_kernel_by_id, comparing them with the dataclass-based accessor pattern in the sokovan lifecycle view. Then inspect the session, kernel, agent, and schema modules under gql_legacy and the repository, model, registry, and test loader-option sites. Done means all listed relationship usages and dependent loader options are converted to explicit repository/ops queries, with batched assembly preserved and the relationships removed.

Written by the indexing model from the issue text.