feat(cli): split bundled session state root from injected config root

[Astro-Han]

Today packages/cli/src/runtime-bootstrap.ts derives sessions, runs, artifacts, connections, credentials, settings, and device identity from a single workspaceRoot. A portable Session Bundle must never contain credentials or host configuration, so we need a hard boundary before any bundle export exists.

Scope

1. Inventory every store rooted by the CLI/runtime bootstrap; classify each as session-owned state vs injected host configuration.
2. Introduce explicit stateRoot / configRoot inputs at the nearest shared bootstrap seam; current CLI/Desktop paths remain the backward-compatible defaults.
3. Define one auditable export policy: includes only session-owned state; explicitly excludes credentials, connection configuration, device identity, storage-root marker, temporary activation input, and logs.
4. Export fails closed on symlinks, path escape, unknown protected entries, or unsafely overlapping roots.
5. Tests: legacy path compatibility, root isolation, cross-session leakage, symlink/path traversal, credential canaries proving exported material contains no secrets.

Out of scope

Control plane, KV/CAS, compression and size policy, maka activate, activation deduplication.

[Astro-Han]

per #1286, this sub issue is assigned to @Nyvo-io.

[Nyvo-io]

Implemented and opened PR #1349: #1349

The PR includes:

• explicit stateRoot / configRoot separation at the CLI runtime bootstrap seam, with legacy workspaceRoot defaults preserved;
• a fail-closed Session Bundle export policy for one requested session, including per-session artifact metadata and SQLite filtering;
• exclusions for credentials, connection config, device identity, storage markers, activation inputs, logs, SQLite sidecars, symlinks, path escapes, unknown entries, and unsafe root overlaps;
• focused tests for root isolation, legacy compatibility, cross-session leakage, credential canaries, symlink/path escape, and root overlap.

Verification is complete: storage 421 passed / 1 skipped out of 422 tests, CLI 640/640 passed serially, and the independent ShellRun regression tests passed 3/3. Ready for review.