fix: isolate sessions by header cwd - #157

Summary

• Filter current-project session listing and --continue by the session header's actual cwd, even in a default encoded directory. Two paths such as project-a and project/a encode to the same session directory and could previously select — and append to — each other's sessions.
• Add a regression test for both the native and the Step session manager, covering the default and the explicit --session-dir path, the cross-project append case, and the "only the other project has a session" case. listAll stays unscoped on purpose and the test pins that.

Behavior change

Sessions whose header carries no cwd (or whose recorded cwd no longer matches — e.g. after the project directory was renamed or moved) no longer appear in list and are not resumed by --continue. They remain visible through listAll. Previously such files were resumable from any project whose encoded directory collided with theirs, which is exactly the bug being fixed.

Verification

• Reproduced the bug in five independent runs before the fix.
• npm run check
• ./test.sh — full workspace suite green (coding-agent: 274 files / 3496 tests, apps/cli: 624 tests).

Fixes #156.