refactor: resolve session artifact paths without a store

[thymikee]

Summary

Session directory and app-log paths now come from the existing artifact-path module. Stale-claim recovery resolves paths from the dead owner's state directory directly, without constructing a session store. Store consumers delegate to the same validated functions.

Removes the SessionStore.expandHome forwarder and migrates all nine production callers to expandSessionPath. Path sanitization, errors, filenames and cwd handling are preserved. Moves the existing path tests to their defining modules, retaining their assertions.

Depends on #3133. Ref #3116. Ten files, 191 gross changed lines.

Validation

Tested 64f40ac3bf5b081a98b09b204bf72a482c8d3a7d:

• 38 focused tests pass across four files; zero skips.
• Quick checks and Fallow pass.
• Exact-head affected checks pass: 388 files, 2,709 related tests; zero skips.
• Independent read-only audit confirms preserved path validation/layout, recorded-owner recovery scope, complete caller migration and test discovery. No findings.
• CI-owned coverage and provider checks remain pending.

[github-actions]

Size Report

Metric	Base	Current	Diff
Installed (including dependencies)	4.94 MB	4.94 MB	-357 B
Package (unpacked)	4.94 MB	4.94 MB	-357 B
Package (download)	1.48 MB	1.48 MB	+162 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	27.7 ms	27.6 ms	-0.1 ms
CLI --help	82.3 ms	81.8 ms	-0.4 ms

[cubic-dev-ai]

All reported issues were addressed across 10 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[thymikee]

This PR is ready at 64f40ac. The code looks right, and the moved tests keep their assertions. All 14 checks pass, and there are no conflicts. It waits only on its base, #3133, landing. Not blocking, and you can take or leave these: device-claim-reconciliation.ts line 28 still joins safeSessionName(claim.session) itself, so it skips the empty, . and .. refusal in resolveSessionDir, and durable-capture-resource.ts line 58 does the same from a package that cannot import src/daemon, so a follow-up could route the first through resolveSessionDir and inject it into capture-kit; the doc on isSafeSessionSegment still names SessionStore.resolveSessionDir, and it should point at resolveSessionDir in session-artifact-paths.ts. I did not run the tests, and I read the #3138 follow-up only through your comment, not its diff.