harden: use filepath.VolumeName in the session-ID volume check

Per PR review (pjbgf): adopt the idiomatic filepath.VolumeName check for Windows volume references. Kept alongside the explicit ":" check because VolumeName is a no-op off Windows — the "C:foo" regression test would not exercise it on a non-Windows CI host, and the ":" form should be rejected on every platform regardless.