fix(host): contain discovered session transcripts

[riverpilot]

Summary

• reject symlinked transcript entries during filesystem discovery
• enforce canonical containment beneath the configured session root
• replace the previous symlink-alias test with internal and external escape coverage

Addresses the security blocker found while reviewing #98. The original compatibility implementation is superseded by current main's official authority mode.

Screenshots

No visual change.

Testing

• pnpm --filter @t4-code/host-service typecheck
• pnpm --filter @t4-code/host-service test (330 passed)
• focused lint on changed files

Risk

• Existing symlinked transcript aliases are intentionally no longer discovered.

Notes

• Built directly on current main; feat: show standard OMP sessions in view-only mode #98 should close rather than merge.

AI Review Report

• Implements canonical-root and symlink hardening requested on feat: show standard OMP sessions in view-only mode #98.

Security Audit

• Blocks transcript disclosure through symlinks escaping --session-root.