feat(setup): disable session URL in commit/PR attribution

[rlorenzo]

Summary

Extends the Claude Code settings step in setup to also disable the session URL in attribution, and migrates existing configs that predate this key.

• Apply now sets .attribution = {"commit":"", "pr":"", "sessionUrl": false} via a merge ((.attribution // {}) + {...}), so it preserves any existing attribution keys instead of replacing the object.
• Detection offers the change when attribution is unset (fresh install, as before) or when a prior run left commit/pr blank without sessionUrl (adds just the new key).
• Prompt description updated to "disable commit/PR/session attribution tags".

Stays opt-in behind the existing Apply these settings? prompt.

Behavior

Existing attribution	Result
missing	offers, sets {commit:"", pr:"", sessionUrl:false}
{commit:"", pr:""} (old setup)	offers, adds sessionUrl:false
{commit:"", pr:"", sessionUrl:false}	nothing to do
{commit:"My template", pr:""}	custom commit respected, untouched
blank commit/pr + extra key	migrated, extra key preserved
{... sessionUrl:true}	user opted in, untouched

Test plan

• bash -n setup passes
• Pre-commit hooks pass (shellcheck, BATS)
• Verified the detection and apply jq expressions against all six scenarios above