docs(sync): correct the ownership precedence the fix inverted

Review found the owning documentation still describing the behaviour this
branch replaced, in one case stacked directly above the new docstring saying
the opposite. Holding a session proves containment, not ownership, so every
text that called store membership the authoritative mapping was actively
misleading for the module whose wrong answer misroutes every send.

Corrected in the module docstring, the resolution module's precedence
description, the sync-refs helper it points at, and the sync DOCUMENTATION.md
table and rules.

The debug report built its authoritative value membership-first, so for exactly
the scenario this branch fixes it reported the parent directory and could raise
a source-disagreement alert while routing was in fact correct. It now uses the
same record-first order as the resolver.

The CLI timeout comment claimed the wait and provisioning windows were additive
while the code took the larger of the two. The server provisions the worktree
inside session creation, before it waits for the session to go idle, so they do
run in sequence: the windows are now summed and the tests pin both cases.

packages/ui/src/sync/sync-refs.ts

@@ -123,13 +123,15 @@ export function getAllSyncSessionMap(): ReadonlyMap<string, State["session"][num
 }
 
 /**
- * Directory of the child store that actually holds this session.
+ * Directory of a child store that holds this session.
  *
- * This is the authoritative session→directory mapping: a session is present in
- * exactly the store for the directory it belongs to, regardless of whether the
- * server populated `session.directory` on the record itself. Returns `null`
- * when no initialized child store contains the session, which means "unknown",
- * never "no directory".
+ * This reports containment, not ownership, and a session can be held by more
+ * than one store: a project's session list includes the sessions of its
+ * worktrees so the sidebar can group them, so the parent repository holds
+ * worktree sessions too. Ownership comes from the session record's own
+ * directory; this is the fallback for a record that carries none. Returns
+ * `null` when no initialized child store contains the session, which means
+ * "unknown", never "no directory".
  */
 export function getSyncSessionDirectory(sessionId: string): string | null {
   if (!sessionId) return null