fix(strategy): prevent shadow cleanup with malformed session state

[ChetanReddyC]

Summary

• keep StateStore.List tolerant for observational callers
• add StateStore.ListStrict for operations requiring a complete inventory
• make both unattended shadow-cleanup paths fail closed when any session state cannot be loaded
• document the cleanup safety contract

When persisted session state is malformed, cleanup now aborts instead of potentially deleting a still-needed shadow ref.

Closes #2350

Testing

• go test ./cmd/entire/cli/session -run 'TestStateStore_List_(SkipsMalformedState|Strict_RejectsMalformedState)$' -count=1
• go test ./cmd/entire/cli/strategy -run 'Test(CleanupPushedShadowBranches_MalformedStateFailsClosed|DeleteShadowBranchesIfUnchanged_MalformedStatePreservesBranch)$' -count=1
• go vet ./cmd/entire/cli/session ./cmd/entire/cli/strategy
• repository-wide formatting, module-tidiness, policy, and ShellCheck verification

Full Windows package runs still encounter existing temporary-directory lock failures reproduced unchanged on origin/main.