[ITSGJY]

Implements the first yyjeqhc#571 slice for Workflow Session refs.

Key points:

• adds principal-scoped durable ~sN selectors for exact Workflow Session incarnations
• canonicalizes refs before existing Session/Project authorization, lifecycle, guard, audit, and dispatch paths
• keeps canonical wc_sess_* identities authoritative
• keeps recording_session_id canonical-only
• preserves the released Project-ref implementation and storage contract unchanged
• exposes session_ref only on bootstrap/discovery/handoff surfaces

Local validation completed before publishing:

• cargo fmt --all -- --check
• cargo check --locked -p webcodex-core -p webcodex-store -p webcodex-tool-contracts
• cargo check --locked -p webcodex
• focused model-reference/store tests: 3 passed
• business Session schema test: 1 passed
• root session_ref tests: 6 passed
• workflow-resume discovery test: 1 passed
• git diff --check

This Draft PR exists to exercise the fork PR CI before preparing any upstream submission.