harden: scope .git/entire-sessions/ writes to os.Root (defense in depth)

The session-state writers key their filenames on the session ID. The ID is already validated, so this is belt-and-suspenders: route the writes through an os.Root scoped to the entire-sessions directory so the kernel makes escaping the directory impossible even if a validation gap were ever introduced.

• session/state.go: Save's atomic rename now goes through os.Root (Load and Clear already did). Drops the now-unused stateFilePath.
• strategy/session_state.go: StoreModelHint, StoreAgentTypeHint, ClaimSessionStartBanner, LoadModelHint, LoadAgentTypeHint and ClearSessionState now operate via os.Root. Two small helpers (openSessionStateRoot / ...ForRead) remove the repeated preamble.

Go 1.26's os.Root natively supports Rename/OpenFile(O_EXCL)/WriteFile, so the atomic-rename and first-writer-wins semantics are preserved.

The sibling entire-session-locks/ dir is intentionally left as-is: its flock semantics are inode-bound and it is a separate directory.