harden: reject ".", "..", and absolute paths in ValidateSessionID

ValidateSessionID previously rejected only path separators and empty input. A bare "." or ".." is separator-free yet still traverses when an agent uses the ID as a path segment (e.g. Copilot CLI builds

<dir>/<id>/events.jsonl), and the separator check can miss platform-specific absolute forms (Windows drive paths). Reject both.

Because the same validator guards both checkpoint writes and the resume/rewind restore boundaries, this tightens the whole class without affecting UUID-style IDs.