refactor(sessions): drop the repair-prompts pin clear; single-pass scan

A memory-only tools[] pin self-heals: restore_agent_tool_prefix appends every
fresh tool to the pin and persists it (merged != pinned) on the next turn. The
clear_pin flag was also unreachable in scan mode (findings need skill_manage).
So drop clear_pin/_HYGIENE_PIN_TOOLS and clear_system_prompt_for_rebuild, and
reuse update_system_prompt(sid, None), which already nulls prompt+hash and GCs
in one write.

The detector now parses each pin and checks the marker once per row, keyed on
prompt_builder.SKILL_SAFETY_HEADING instead of a hand-copied literal. The scan
classifies each compact_rows page as it arrives, keeps only finding dicts, and
dedupes ids that OFFSET paging can re-serve during concurrent inserts.

hermes_state_sessions.py

@@ -673,25 +673,6 @@ class SessionSessionsMixin:
             self._delete_unreferenced_system_prompts(conn)
         self._execute_write(_do)
 
-    def clear_system_prompt_for_rebuild(
-        self, session_id: str, *, clear_tool_names: bool = False,
-    ) -> None:
-        """Atomically clear a stored prompt and, when requested, its tools[] pin for a fresh rebuild."""
-        def _do(conn):
-            if clear_tool_names:
-                conn.execute(
-                    "UPDATE sessions SET system_prompt_hash = NULL, system_prompt = NULL, "
-                    "tool_names = NULL WHERE id = ?",
-                    (session_id,),
-                )
-            else:
-                conn.execute(
-                    "UPDATE sessions SET system_prompt_hash = NULL, system_prompt = NULL WHERE id = ?",
-                    (session_id,),
-                )
-            self._delete_unreferenced_system_prompts(conn)
-        self._execute_write(_do)
-
     def update_session_model(
         self, session_id: str, model: str, provider: Optional[str] = None, *,
         base_url: Optional[str] = None, api_mode: Optional[str] = None,