Scheduler / predicates / scheduler-type collapse of the owner key:

- ``scheduler/predicates.py``: predicates now take SessionRow and
  resolve ``main_access_key`` from the owner via a helper when a
  keypair-scoped lookup (Redis concurrency, keypair resource policy)
  is required. Renames ``SessionRow.user_uuid`` references throughout.
- ``scheduler/drf.py``: per-user fairness tracking keyed by
  ``owner_id``/``main_access_key`` pair.
- ``repositories/scheduler/options.py``: drop the duplicated
  ``by_access_key_*`` factories — session filters go through
  ``SessionConditions`` helpers instead.
- ``repositories/scheduler/types/*``: rename ``access_key`` to
  ``main_access_key`` on ``ScheduledSessionData``,
  ``TerminatingSessionData``, ``SweptSessionInfo``, ``KernelEnqueueData``
  and ``SessionEnqueueData``.
- ``repositories/events/db_source/db_source.py`` and
  ``repositories/stream/db_source/db_source.py``: resolve the owner
  UUID from ``main_access_key`` via a sub-select shim while the schema
  still exposes ``sessions.access_key``.

- repositories/scheduler/types/session.py: rename
  PendingSessionData.access_key -> main_access_key (and drop the
  outdated resolved-main_access_key comment).
- repositories/scheduler/db_source/db_source.py: update the
  PendingSessionData call site to main_access_key + owner_id keyword
  names matching the dataclass.
- scheduler/drf.py: use existing_sess.user_uuid (SessionRow stores the
  owner UUID there, not owner_id).
- scheduler/predicates.py: guard every _resolve_main_access_key
  consumer (check_concurrency, check_keypair_resource_limit,
  check_pending_session_count_limit, check_pending_session_resource_limit)
  with an early main_ak-is-None return so that NULL main_access_key
  users don't fall through to keypair policy lookups that match with
  NULL.

- repositories/scheduler/types/allocation.py: rename SessionAllocation's
  ``access_key`` field to ``main_access_key`` and drop the stale
  explanatory comment.
- repositories/stream/db_source/db_source.py: raise UserNotFound when
  no user owns the supplied ``main_access_key`` — SessionNotFound was
  misleading since the failure is about the user lookup, not the
  session.
- Drop the leftover ``changes/BA-5650-D.misc.md`` file.

- Scheduler db_source and preparer now use ``main_access_key`` /
  ``owner_id`` on ``SessionEnqueueData``, ``KernelEnqueueData``,
  ``TerminatingSessionData``, ``SweptSessionInfo``, and
  ``ScheduledSessionData``.
- ``PendingSessions.owner_ids`` replaces ``user_uuids`` in db_source
  call sites.
- ``scheduling_controller`` reads ``session_spec.access_key``
  (SessionCreationSpec still uses this name pre-sokovan rename).
- ``PendingSessionData.to_session_workload`` maps
  ``main_access_key`` → ``SessionWorkload.access_key`` and
  ``owner_id`` → ``SessionWorkload.user_uuid`` so the bridge works
  until slice F renames the sokovan SessionWorkload fields.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Scheduler / predicates / scheduler-type collapse of the owner key:

- ``scheduler/predicates.py``: predicates now take SessionRow and
  resolve ``main_access_key`` from the owner via a helper when a
  keypair-scoped lookup (Redis concurrency, keypair resource policy)
  is required. Renames ``SessionRow.user_uuid`` references throughout.
- ``scheduler/drf.py``: per-user fairness tracking keyed by
  ``owner_id``/``main_access_key`` pair.
- ``repositories/scheduler/options.py``: drop the duplicated
  ``by_access_key_*`` factories — session filters go through
  ``SessionConditions`` helpers instead.
- ``repositories/scheduler/types/*``: rename ``access_key`` to
  ``main_access_key`` on ``ScheduledSessionData``,
  ``TerminatingSessionData``, ``SweptSessionInfo``, ``KernelEnqueueData``
  and ``SessionEnqueueData``.
- ``repositories/events/db_source/db_source.py`` and
  ``repositories/stream/db_source/db_source.py``: resolve the owner
  UUID from ``main_access_key`` via a sub-select shim while the schema
  still exposes ``sessions.access_key``.

Rename access_key -> main_access_key on sokovan data types
(SessionAllocation, PreparedSessionData, SessionDataForPull,
SessionDataForStart, SessionWorkload) and update every sokovan caller
accordingly. Affects:

- sokovan/data/{allocation,lifecycle,workload}.py
- sokovan/scheduler/handlers/lifecycle/*
- sokovan/scheduler/handlers/maintenance/sweep_sessions.py
- sokovan/scheduler/provisioner/{provisioner,sequencers,validators}/*
- sokovan/scheduler/launcher/launcher.py
- sokovan/scheduler/post_processors/cache_invalidation.py
- sokovan/scheduler/fair_share/aggregator.py
- sokovan/scheduling_controller/{preparers,scheduling_controller}.py
- sokovan/deployment/{executor,route}.py

No external behavior change.

…comments

- Revert deployment/executor.py, deployment/route/coordinator.py,
  deployment/route/executor.py, deployment/route/handlers/observer/
  health_check.py to the parent branch state — those edits pre-dated
  main and are unrelated to BA-5650; they slipped in when this slice
  pulled the whole sokovan/ subtree.
- sokovan/data/allocation.py: restore the explanatory comment above
  ``main_access_key`` and fix ``from_agent_selections`` to pass
  ``main_access_key=`` (matches the renamed field).
- sokovan/data/workload.py: restore the explanatory comment above
  ``SessionWorkload.main_access_key``.

…ss_keys

- Resolve merge conflicts from cascading onto the updated slice E
  (drf.py keeps ``existing_sess.user_uuid``; predicates.py keeps the
  ``main_ak is None`` early returns; scheduler types stay on
  ``main_access_key``; stream db_source keeps ``UserNotFound``).
- Add ``SchedulerRepository.resolve_main_access_keys`` and the matching
  ``ScheduleDBSource.resolve_main_access_keys`` so the coordinator's
  cache-invalidation step can look up each session's owner
  main_access_key in a single query. Required by
  sokovan/scheduler/coordinator.py and lifecycle/deprioritize_sessions.py
  call sites that were previously reading ``session_info.metadata.access_key``.

- ``SessionWorkload`` now uses ``main_access_key`` / ``owner_id``; the
  ``PendingSessionData.to_session_workload`` bridge is updated accordingly.
- Scheduler db_source constructions of ``SessionDataForPull`` /
  ``SessionDataForStart`` use the new kwargs.
- ``cache_invalidation`` reverts to ``info.access_key``
  (``SessionTransitionInfo`` still carries the old field at slice F).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>