fix: gracefully skip sessions without project field in list()

Adds validation check before metadataToSession() to prevent entire list()
operation from crashing if any session metadata lacks the required project
field. Invalid sessions are now skipped with a warning instead of throwing.

This maintains fail-fast validation in metadataToSession() for direct get()
calls while providing resilience in bulk operations.

Addresses bugbot comment: "One legacy session without project crashes entire
list operation"

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

packages/core/src/session-manager.ts

@@ -451,6 +451,12 @@ export function createSessionManager(deps: SessionManagerDeps): SessionManager {
       // Filter by project if specified (before building session object - more efficient)
       if (projectId && raw["project"] !== projectId) continue;
 
+      // Skip sessions without required project field to avoid crashing entire list
+      if (!raw["project"]) {
+        console.warn(`Skipping session ${sid}: missing required 'project' field`);
+        continue;
+      }
+
       const session = metadataToSession(sid, raw, createdAt, modifiedAt);
 
       // Enrich with live runtime state and activity detection