refactor: remove unrestricted session upsert and deletion

[thymikee]

Summary

Remove unrestricted SessionStore.set and address-only delete. Routes and integration fixtures now publish a new lifetime, update a captured ref with named fields, or retire that ref. This completes the caller migration from #3116; field-ownership enforcement follows.

The concurrency harness retains each published lifetime through cleanup. Provider fixtures expose publishSession instead of an upsert. Scenario resets retire explicitly; redundant re-sets disappear. Eighty-eight files changed, including one production module. Stacked on #3152.

Validation

Validated a6fd685348: quick checks, 311 focused/provider tests across 78 files, and Fallow pass. Independent read-only review found no weakened assertions or lifetime errors.

pnpm check:affected --base refactor/session-fixture-lifetimes-core --run passes all selected runnable gates and 2,091 tests across 317 files.

A cumulative run passed 6,430 tests before an unchanged shared TMPDIR assertion failed; that separate gate then passed all 25 controls. The final full gate remains required. CI is pending; this layer adds no device route.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	4.96 MB	4.96 MB	-137 B
Package (unpacked)	4.96 MB	4.96 MB	-137 B
Package (download)	1.49 MB	1.49 MB	-22 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	20.6 ms	19.9 ms	-0.7 ms
CLI --help	55.7 ms	55.3 ms	-0.4 ms

[cubic-dev-ai]

No issues found across 88 files

_{Re-trigger cubic}

[thymikee]

This PR is ready at a6fd685. The change only removes the unrestricted session upsert and delete methods, and the typecheck confirms no caller is left. All 14 checks pass, and there are no conflicts. Not blocking: the planted-violation strings in session-resource-ownership.test.ts still use sessionStore.set(name, {...}), which no longer exists. The scanner keys on resource field construction, so the test still passes. You can switch them to sessionStore.update(ref, {...}) or leave them. I did not read every test-file hunk, I did not run the tests locally, and I rely on the green checks. Merge #3152, the base of this stack, first, and then this PR can land.

[thymikee]

Consolidated into #3152 as part of reducing #3116 to seven PRs. The composition preserves the complete pre-consolidation source tree, including tests and later review corrections. This PR is superseded; its review discussion and native evidence remain available. Outstanding findings transfer to the owning keeper in the implementation record.