test(session): accept digit-only hex rule ids

[BegoniaHe]

Summary

Windows blocking pytest failed on master because secrets.token_hex(6) can emit a 12-character all-digit hex id. str.islower() is false for strings with no cased characters, so assert watch.rule_id.islower() rejected a valid id such as 225823821909. The assertion now matches the existing lowercase-hex check, and a regression insert pins that all-digit id.

Related issue

Related: master CI Run blocking pytest suite (windows-latest) on 35be83b28 (https://github.com/Xero-Team/AstrBot/actions/runs/34996351692/job/104485180566)

Surfaces

• tests/unit/db/test_session_bridge_store.py

Implementation notes

Keep allocated rule ids as lowercase hex from token_hex(6). Do not force a letter into the id; the product contract already allows all-digit hex. Align the store test with tests/unit/test_session_bridge.py, which already uses rule_id == rule_id.lower().

Validation

uv run ruff format tests/unit/db/test_session_bridge_store.py
uv run ruff check tests/unit/db/test_session_bridge_store.py
uv run pytest tests/unit/db/test_session_bridge_store.py tests/unit/test_session_bridge.py::test_watch_records_rule_id_and_rejects_zero_ttl -q

make check and the full blocking suite were not run. This change is test-only.

Compatibility and risk

None for product behavior. Residual risk is another Windows-only flake elsewhere; this PR only covers the failed rule_id.islower() assertion.

Checklist

• Conventional Commit type is chore, build, ops, or test (not ci).
• The change is focused and does not include unrelated product refactors.
• A toolchain upgrade updates every matching declaration, workflow, image build, and lockfile.
• Runtime Python deps update pyproject.toml, requirements.txt, and uv.lock together.
• I ran the relevant formatting, lint, build, and test commands.
• No secrets committed.
• I did not restore legacy shims, Python <3.14 fallbacks, or upstream publish/docs URLs as fork artifacts.
• I will not merge this PR myself. Merge needs a human maintainer review plus a separate AI-assisted review (AI_POLICY.md).
• AI use follows AI_POLICY.md. Keep exactly one author note below. Do not fabricate the other.

Agent note

Goal: restore the Windows blocking suite after master commit 35be83b28 failed test_insert_session_bridge_rule_writes_s1_defaults. Path touched: tests/unit/db/test_session_bridge_store.py. Checks run locally: Ruff format/check on that file, focused pytest (7 passed). I did not push master; this PR is the CI trigger. Merge still needs a human maintainer review plus a separate AI-assisted review.