fix review attach metadata guard

Check existing checkpoint sessions through metadata so review attach refuses metadata-only sessions before rewriting them.

Cover the missing-state regression with a focused attach test.