fix: validate session IDs on resume/rewind to prevent arbitrary file write

Session IDs read from checkpoint metadata on the shared entire/checkpoints/v1 branch flowed into agent.ResolveSessionFile + WriteSession during entire session resume and entire checkpoint rewind with no validation. A crafted absolute or "../"-laden session ID escaped the agent session directory (and for Codex/Pi, which return absolute IDs verbatim, landed anywhere), letting attacker-controlled transcript bytes overwrite arbitrary files such as ~/.bashrc — RCE on the next resume, with no prompt shown to the victim.

Validate the session ID with validation.ValidateSessionID at the two restore choke points before any path construction:

• resolveTranscriptPath (covers resume-single, rewind restore, attach)
• RestoreLogsOnly write + status loops (multi-session resume/rewind)

This mirrors the invariant already enforced when checkpoints are written, so it cannot reject a legitimately-created checkpoint while closing every separator/absolute traversal. Unsafe IDs are rejected (resolveTranscriptPath) or skipped with a warning (RestoreLogsOnly).

Adds end-to-end and choke-point regression tests proving a traversal session ID writes nothing outside the agent session directory.