Sessions: dual-read legacy formats with corruption diagnostics - #182

Review: approved ✅

Scope: read-side session compatibility only — no writes, no migration. That separation is the right call and is what makes this safe to land ahead of #185's canonical writer.

What I checked

• The tail-vs-middle corruption rule is the correct policy: an interrupted final append is the expected failure mode for an append-only JSONL writer killed mid-line, so tolerating it recovers real sessions. Middle corruption is genuinely anomalous and reporting an exact line number makes it diagnosable rather than a silent truncation.
• Desktop metadata recovery when the core sidecar is missing means desktop-created sessions stop being invisible to CLI listings — that gap was a real user-facing symptom.
• The same rule is applied in the Rust reader, so core and desktop agree on what "recoverable" means. Divergence there would have been a nasty long-lived bug.
• The explicit test that compatibility reads do not mutate legacy bytes is the assertion I most wanted to see. Read-path code that quietly rewrites what it parses is how session history gets destroyed; pinning it in a test is the right defence.

Note: this PR deliberately leaves canonical write normalization and single-writer ownership to #185. Reviewing them together, the split holds — nothing here presumes the writer contract.

Validation: CI green. cargo test 31 passing per the PR body; full suite green locally at the stack tip.