feat: attribute session counts by app family - #28337

Groups app names into families on the read paths, so a session reported under a new name is counted rather than dropped.

• codersdk gains the attribution registry: appNameFamilies maps each known app name to a family, and SessionCountAppFamiliesJSON() renders the attributed families as a single jsonb parameter. A session reported as cursor counts as VS Code in template insights, deployment stats, Prometheus, and telemetry.
• The read queries take that one app_families parameter instead of four hardcoded name lists. Adding an alias to an existing family is one registry edit that flows everywhere. Adding a family is a registry edit plus one probe per reporting query, since sqlc output columns are static; validation and a pinning test turn a miss into a loud failure instead of a silently zeroed column.
• dbauthz validates the registry structurally: exactly the probed families, each with a non-empty alias list. {}, null, a renamed family, or an extra family fail with the offending key named. It overrides the generated stubs through the scripts/dbgen external-method mechanism, covering every production store including rollup transactions.
• The insights inclusion filter matches any session rather than the four known names, so an unrecognized app costs unattributed minutes instead of an idle user.
• The per-agent sum sites decompose session_counts once per row, one jsonb_each_text with a filtered sum per family, instead of a correlated subplan per family. Insights only tests key presence and keeps the ?| probe, which is faster there.
• TestEveryFamilyIsAttributed fails if a family is added with nowhere to report it. TestAttributedAppFamiliesMatchQueries pins the registry to the families the SQL probes. TestSessionCountsAttributeByFamily and TestUpsertTemplateUsageStatsAttributesSessionCountsByFamily pin the behavior end to end, including the rollup: cursor as VS Code, zed as SSH, an unknown name still marking the user active.

Measurements

PG 13, 1M rows, parallelism off, median of 3. The previous per-family correlated subplan against the shipped single-pass fold:

The gating predicates ride inside the lateral as one-time filters, so the decompose is skipped for rows that are not counted, and a per-agent EXCEPT in both directions over 5000 agents returns zero rows. The insights sites invert this: ?| on the alias array measured 613 ms against 1500 ms for decomposing, so presence checks keep ?|.

Trade-offs

• Family membership is a server-side alias list, so counting a new IDE under an existing family still needs a Coder release. A per-name breakdown is a later phase.
• The insights filters test key presence, which equals a positive count only because writers strip non-positives. Testing the value there costs 2.4x, so this relies on the invariant that workspace_agent_stats.session_counts documents.
• Attribution lives in one registry, but a new family still needs one probe expression per reporting query. The structural validation and the pinning test make that requirement fail loudly rather than silently.
• Lands before the producers, so the alias plumbing sits unused until feat: report arbitrary workspace agent session types #28338. The other order would accept new names without counting them.

Depends on #28126. Phase 4 of #27410. Stacked on top: #29134 makes the count queries return per-app counts, and #29109 replaces the fixed per-family minute columns and the per-query probes.

Update generated by Coder Agents for @EhabY.