refactor: resolve session artifact paths without a store

[thymikee]

Summary

Session directory and app-log paths now come from the existing artifact-path module. Stale-claim recovery resolves paths from the dead owner's state directory directly, without constructing a session store. Store consumers delegate to the same validated functions.

Removes the SessionStore.expandHome forwarder and migrates all nine production callers to expandSessionPath. Path sanitization, errors, filenames and cwd handling are preserved. Moves the existing path tests to their defining modules, retaining their assertions.

Depends on #3133. Ref #3116. Ten files, 191 gross changed lines.

Validation

Tested 64f40ac3bf5b081a98b09b204bf72a482c8d3a7d:

• 38 focused tests pass across four files; zero skips.
• Quick checks and Fallow pass.
• Exact-head affected checks pass: 388 files, 2,709 related tests; zero skips.
• Independent read-only audit confirms preserved path validation/layout, recorded-owner recovery scope, complete caller migration and test discovery. No findings.
• CI-owned coverage and provider checks remain pending.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	4.95 MB	4.95 MB	-351 B
Package (unpacked)	4.95 MB	4.95 MB	-351 B
Package (download)	1.48 MB	1.48 MB	+299 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	17.7 ms	17.1 ms	-0.5 ms
CLI --help	50.6 ms	51.9 ms	+1.3 ms

[cubic-dev-ai]

All reported issues were addressed across 10 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[thymikee]

This PR is ready at 64f40ac. The code looks right, and the moved tests keep their assertions. All 14 checks pass, and there are no conflicts. It waits only on its base, #3133, landing. Not blocking, and you can take or leave these: device-claim-reconciliation.ts line 28 still joins safeSessionName(claim.session) itself, so it skips the empty, . and .. refusal in resolveSessionDir, and durable-capture-resource.ts line 58 does the same from a package that cannot import src/daemon, so a follow-up could route the first through resolveSessionDir and inject it into capture-kit; the doc on isSafeSessionSegment still names SessionStore.resolveSessionDir, and it should point at resolveSessionDir in session-artifact-paths.ts. I did not run the tests, and I read the #3138 follow-up only through your comment, not its diff.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-10-03 19:39 UTC

[thymikee]

#3186 lands the unchanged path-helper patch on main at a4efad510b4df439f397765769ce2f860c1571e8. GitHub marked this PR merged into its former feature base during the stack reorder; that event did not land the helper on main.

The replacement preserves the reviewed patch (git range-diff is identical). Its exact-head affected gate passes 2,679 tests across 389 files, and fresh CI is running. The remaining 25 layers are grouped in native stack #3187 beneath that independent dependency.