core: deepen session filesystem module

[fosskar]

Summary

• replace Wiremap with a deep SessionFilesystem module owning adapters, discovery, translation, freeze policy, and contained mutation
• internalize the path-map Resolver and move behavioral tests to the filesystem interface
• bound header probing at 64 KiB, skip descendant symlinks, and reject lexical or symlinked write/read escapes
• preserve mapped exclude symmetry and DECISIONS §9 artifact ordering

Performance

10,000-session release benchmark, median of seven scans:

• baseline: 39.293 ms, RSS +2,712 KiB
• new module: 23.494 ms, RSS +260 KiB

Temporary benchmark harness removed.

Verification

• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace — 240 passed
• nix fmt -- --ci

Stacked on age-subprocess-hardening.