fix(security): harden SessionId path handling, secret-mask nonce, stale comment

[bug-ops]

Summary

Bundles two small, non-blocked, defense-in-depth hardening fixes into a single PR:

• P3 hardening: SessionId lacks path-traversal validation; stale unsafe-code-confinement claim; explicit CSPRNG for secret-mask nonce #6349 — three low-severity hardening gaps, none exploitable today:
  • SessionId::try_new validating constructor rejects /, \, .., and NUL bytes.
    Applied at the 5 HTTP handlers in src/serve/handlers.rs that take a caller-supplied
    session id (get/delete/prompt/events/fork_session_handler), each now
    returning 400 on rejection. SessionId::new is unchanged and remains the
    constructor for trusted call sites (internal generation, test fixtures, already
    DB/registry-validated round-trips) to avoid ~90-call-site churn for a
    not-exploitable-today issue.
  • SecretMaskRegistry::new's per-registry nonce now uses rand::rngs::SysRng
    (explicit OS-backed CSPRNG) instead of rand::random()'s default thread-local
    generator.
  • Corrected a stale src/main.rs comment claiming all unsafe code is confined to
    that module.
• evaluate enabling clippy::await_holding_lock workspace-wide #6355 — enabled clippy::await_holding_lock workspace-wide in
  [workspace.lints.clippy], after verifying zero hits across every CI feature
  combination.

Notes

• crates/zeph-experiments is the only crate missing [lints] workspace = true
  (pre-existing, unrelated to this PR) and is therefore not covered by the new lint.
  Follow-up filed as chore(arch): zeph-experiments missing [lints] workspace = true — excluded from await_holding_lock and all other workspace lints #6371.
• Full CI-matching suite (fmt, clippy --profile ci, nextest, rustdoc gate, doc-tests,
  gitleaks) run and independently re-verified by the reviewer — all green.

Closes #6349
Closes #6355

Test plan

• cargo +nightly fmt --check
• cargo clippy --profile ci --workspace --all-targets --features "desktop,ide,server,chat,pdf,scheduler,testing" -- -D warnings
• cargo nextest run --config-file .github/nextest.toml --workspace --features "desktop,ide,server,chat,pdf,scheduler" --lib --bins (13985 passed, 0 failed)
• Rustdoc gate (RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace)
• cargo test --doc -p zeph-common -p zeph-sanitizer
• gitleaks protect --staged — clean
• New unit tests: 7 SessionId::try_new tests + 4 handler *_rejects_path_traversal_id tests
• .local/testing/playbooks/security-hardening.md and coverage-status.md updated