Stable identity for TimeTracker session ingestion

A reusable ingestion pattern for Cosmos TimeTracker exports: derive normalized message identity from canonical session ID plus source sequence, not the mutable message-table UUID; retain both the database UUID and stored-message ID as provenance. Before accepting full content, independently match explicit session-level consent, owner, and repository scope, validate strict sequence order, and verify UTF-8 byte size plus SHA-256. Error/log surfaces should contain metadata-only reasons, never raw text. This was validated with synthetic tests only; no real session content was used.