* Changelog: credit session path fixes * Sessions: harden path resolution for symlink and stale metadata * Tests: cover fallback for invalid absolute sessionFile * Tests: add symlink alias session path coverage * Tests: guard symlink escape in sessionFile resolution