Slice A scope is only the new get_main_access_key_by_id helper and the
SessionConditions rewrite. Accidentally dropping the
target_main_access_key argument from delegate_endpoint_ownership
belongs to a later slice that also updates EndpointRow and the user
service; restoring the signature here so this PR builds standalone.

Rename UserPermission.user_uuid to owner_id and add main_access_key:
str | None. KernelRow.to_kernel_info populates the new field from the
eagerly-loaded user_row relationship; search_kernels now selectinload's
user_row so the scalar is available without N+1.

KernelRow.delegate_ownership drops its access_key argument (resolved
from the owner). recalc_concurrency_used switches from
KernelRow.access_key to a KernelRow.user_uuid subquery keyed by the
owner's main_access_key as a shim for the eventual access_key column
drop.

Test fixtures that construct UserPermission are updated.

Earlier the branch pulled test fixtures that also referenced later
slices' renames (SessionMetadata.owner_id, ScheduledSessionData
.main_access_key, SessionDataForPull/Start.main_access_key,
SessionData.owner_id). Revert those fixtures to main state and
re-apply only the UserPermission field renames (user_uuid -> owner_id,
access_key -> main_access_key) which are in this slice's scope.

Also update the two remaining live readers of UserPermission:
- sokovan/scheduler/fair_share/aggregator.py
- api/adapters/session.py (kernel_info_to_node)

And fix the SessionRow.delegate_ownership caller of
KernelRow.delegate_ownership to match the new single-argument signature.

Data-layer rename of SessionData / SessionMetadata user_uuid to
owner_id, plus the matching SessionRow adapters
(to_dataclass/from_dataclass/to_session_info/from_session_info).
ComputeSessionNode.from_dataclass becomes async and resolves
main_access_key from the owner via UserRepository when owner is not
eagerly loaded. models/resource_usage.py sources user_id from
SessionRow.user_uuid through the session relationship.

SessionRow._build_session_fetch_query / _match_sessions_by_* also
rename the filter parameter to owner_id; repository and db_source
callers are updated in the next slice so intermediate builds may
fail in isolation.

``SessionRepository`` and the underlying ``SessionDBSource`` now take
``owner_id: UUID`` on every method that previously accepted
``owner_access_key: AccessKey``. Affects:

- ``get_session_validated``
- ``match_sessions``
- ``update_session_name``
- ``find_dependency_sessions`` / ``_find_dependent_sessions``
- ``get_target_session_ids``
- ``get_session_with_group``

The matching ``dependency_graph`` helpers and ``creators`` are updated
in lockstep. Service-layer callers still pass ``owner_access_key``
temporarily; they will be migrated in the next slice.

- repositories/session/creators.py: docstring pointed to a non-existent
  ``owner_id`` attribute on SessionRow; clarify that the scope_id
  comes from ``user_uuid`` (the owner's UUID).
- repositories/session/db_source/db_source.py: drop the redundant
  ``session_row.user_uuid is not None`` guard (the column is
  non-nullable); update the ``_find_dependent_sessions`` docstring to
  reference ``owner_id`` instead of the removed ``access_key`` param.

- Drop the leftover ``changes/BA-5650-C.misc.md`` file that was
  superseded when slice C's fragment was renamed to
  ``changes/11045.enhance.md``.
- Remove the explanatory comment about ``user_uuid`` being non-nullable
  from the ``update_session_name`` path — it restates what the
  surrounding code already makes clear.

After rebasing on slice C, three residual references in
``session/db_source/db_source.py`` still used the old ``access_key``
variable name. This commit finishes the rename in:

- ``get_session_validated`` / ``match_sessions`` / ``update_session_name``
  (now forward ``owner_id=...`` instead of the leftover
  ``owner_access_key`` keyword).
- ``_find_dependent_sessions`` and ``get_target_session_ids`` (now pass
  the local ``owner_id`` UUID instead of the non-existent ``access_key``).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>