fix: filter invalid session IDs in listMetadata to prevent downstream crashes

listMetadata() now validates filenames against VALID_SESSION_ID regex
before returning them, preventing readMetadataRaw() from throwing on
unexpected files in the sessions directory.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/core/src/metadata.ts

@@ -192,6 +192,7 @@ export function listMetadata(dataDir: string): SessionId[] {
 
   return readdirSync(dir).filter((name) => {
     if (name === "archive" || name.startsWith(".")) return false;
+    if (!VALID_SESSION_ID.test(name)) return false;
     try {
       return statSync(join(dir, name)).isFile();
     } catch {