session.id_headers replaces the built-in default rather than extending it, so the --local config silently disables Bob grouping

Summary

session.id_headers in YAML replaces the Go default list wholesale. Two changes
landed a day apart that each add an agent's session header, in two different places —
and because of that override rule they do not compose:

The YAML wins, so on a fresh --local install X-Task-Id is never consulted and Bob
traffic falls back to the shared default bucket — the exact outcome #1058 was filed to
fix. Nothing warns; the header is simply not in the list.

Reproduced on main (7660772c)

Feeding the session block that writeBuiltinConfig emits through the real loader:

with the generated --local config: [X-Claude-Code-Session-Id X-Session-Id]
with no session block (Go default): [X-Claude-Code-Session-Id X-Task-Id]

Who is affected

• New installs, and anyone who deletes ~/.cortex/config.yaml to regenerate it —
  they get the two-header YAML and lose X-Task-Id.
• Existing users are fine, for now. writeBuiltinConfig keeps an existing config
  ("local mode — keeping the existing config"), and configs written before #1062 have no
  session: block at all, so the Go default applies. That also means the bug is latent:
  it appears on the next clean install rather than on upgrade.

Why this is a design question, not just a missing header

Adding X-Task-Id to the generated YAML fixes today's instance and leaves the trap. The
underlying rule is that an operator who names any header silently loses every
built-in one, and that failure is invisible — a bucket that does not appear looks exactly
like an agent that sent no traffic. It is documented (SessionConfig.IDHeaders,
authbridge/docs/laptop-service.md), but documentation is what we already had.

Worth considering, roughly in order of cost:

1. Do not write session.id_headers into the generated config at all. The Go default
   already covers the shipped agents, and writing it out is what created the divergence.
   Add new agents' headers in one place, in Go. Keeps [] working as the off switch.
2. session.id_headers_extra — a list that appends to the default instead of
   replacing it, for operators adding a header we do not ship.
3. Warn at load when an explicit list omits a header the build knows about. Cheapest,
   but it puts a line in everyone's log for a deliberate choice.

Option 1 also removes the "two homes for the same concept" problem: right now a reader
has to know which of the two lists is authoritative, and the answer depends on whether a
file happens to exist.

Not urgent

No user is broken today (see "Who is affected"), and the workaround is a one-line config
edit. Filing so the next agent integration does not land in the same trap, and so
whichever of the three options is right gets chosen deliberately.

Refs #1058, #1062.

Start with SessionConfig.SessionIDHeaders() and the generated-config path in writeBuiltinConfig, then trace the real loader behavior for an explicit session.id_headers block. Review authbridge/docs/laptop-service.md and refs #1058/#1062 to understand the intended default and override semantics. Done means one configuration rule is chosen and applied consistently, the clean --local case preserves the intended headers, and the documentation matches it.