feat(integrations): add opt-in automatic per-project dataset isolation

[netbrah]

Problem

The Python hook integrations default to one global dataset,
agent_sessions. Sessions are unique per host conversation, but graph recall
searches the entire dataset, so unrelated repositories can inject each other's
memory.

Users can set COGNEE_PLUGIN_DATASET manually, and #285 proposes a committed
Claude Code project picker. Neither provides automatic, cross-harness project
isolation.

Proposed behavior

Add an opt-in shared setting:

COGNEE_DATASET_SCOPE=project

When enabled, every supported Python hook integration derives the same stable
dataset for the same project while retaining its existing unique session per
host conversation.

Dataset precedence:

1. explicit COGNEE_PLUGIN_DATASET
2. explicit project picker from feat(claude-code): project-level .cognee/session-config.json dataset picker (SDK-304) #285, when present
3. automatically derived project dataset when COGNEE_DATASET_SCOPE=project
4. existing agent_sessions default

The upstream default remains unchanged.

Project identity

• Prefer a normalized Git origin identity.
• Normalize equivalent SSH/HTTPS remotes, remove credentials and .git, and
  never place raw credentials or a full local path in a dataset name.
• Git clones and worktrees of one normalized remote share a project dataset.
• A Git repository without a remote falls back to its canonical common Git
  directory.
• A non-Git workspace falls back to its canonical workspace path.
• Emit a bounded, server-safe name such as
  project_<sanitized-slug>_<stable-hash>.

Resolution must be local-only, bounded by subprocess timeouts, fail open to
agent_sessions, and never invoke a shell.

State and migration

• Do not globally pin COGNEE_SESSION_ID.
• Do not migrate, merge, delete, or rewrite the existing agent_sessions
  dataset.
• Newly scoped project datasets start empty.
• Detached workers and status surfaces must use the same dataset selected at
  session start.

Integration scope

• Implement and test Claude Code and Codex from current main.
• Keep the resolver contract host-neutral so Qwen (feat(qwen): add first-class Cognee memory extension #354) and Antigravity (feat(antigravity): add first-class Cognee memory plugin #355)
  can adopt it without changing dataset identity.
• Add Qwen/Antigravity parity to the PR if those integrations land before this
  work is merged; otherwise follow up without blocking the core change.

Acceptance criteria

• Two conversations in one project get distinct session IDs and the same
  derived dataset.
• Different projects get different datasets.
• Equivalent SSH/HTTPS remotes and linked worktrees resolve identically.
• An explicit dataset always wins.
• feat(claude-code): project-level .cognee/session-config.json dataset picker (SDK-304) #285's project picker wins when both features are present.
• Non-Git workspaces resolve deterministically.
• Malformed remotes, Git failures, and timeouts fall back safely.
• Writes, recall, status output, background workers, and final sync agree on
  the selected dataset.
• Shared hermetic tests, Ruff format/lint, Linux CI, and Windows CI pass.

Related work

• feat(claude-code): project-level .cognee/session-config.json dataset picker (SDK-304) #285 — manual, committed Claude Code project dataset picker
• feat(claude-code): mid-session dataset switch (seal bridge + re-register) (SDK-306) #292 — mid-session dataset switching (out of scope here)
• feat(qwen): add first-class Cognee memory extension #354 — Qwen integration
• feat(antigravity): add first-class Cognee memory plugin #355 — Antigravity integration

[Vasilije1990]

@netbrah can you check agent identity provisioning i released i nthe SDK: topoteretes/cognee#4563

Might be better to rewrite it with that in mind