Sessions inside Work, Explore second in the rail, and the fixes a review of work items finds #156

Shipped in e59e4c99 (Deploy #430, CI #351).

• Rail: Home, Explore, Work. Sessions is a section of Work at /<ws>/-/work/sessions. The phone app and the native app match.
• Docs: Work has its own section in the docs (docs.g1t.sh/work/). Its pages' old URLs redirect, anchors included.
• Review: a read-only review found leaks, and every one is fixed with a regression test:
  • work item context, blockers, sessions, events and suggestions shown to viewers who may not see them
  • events of items with no origin filed under a public linked repository
  • titles of private items on commit pages
  • closing keywords closing items the closer can't see
  • webhook fan-out to linked repositories
  • private repositories revealed by reference lookups (verified live: anonymous session-lab/refs/2 answers none)
• Correctness: a transferred repository closing items in its old workspace, partial landings notifying dependents too early, and pull request numbers colliding with old issue numbers.
• Repair: the deleted but restorable flagon-io/hello's 42 items have their path, visibility and labels back. Verified live: #58 is public again, and ci and webhook are labels.
• Smaller fixes: agents.md names work items, and Work's lists, board, links and empty states are corrected.