#4389 fix(daemon): contain session artifact paths

Summary

Use the existing contained session-directory owner for remote diagnostics and retained-claim recovery. Invalid names retain claim evidence and cannot write outside the records directory. The optional CLI diagnostic tail now contains both path-resolution and read errors, preserving the original failure.

Six files change. Two CLI consumer files were added after review found its uncaught path rejection. Fixes #4373; part of #4368.

Validation

Head: 8b2dfb9eb534bb324d8fa19e4aedd389465cbc8d.

• All eight runnable exact-head affected checks passed; exactCommit=true, checkoutChanged=false. Related: 342 passed; unit: 17,833 passed/one unidentified skip. Seven skipped gates retain their owners. Receipt and obligations.
• Focused: 33 passed. Published 18c plus final fixtures: 2 failed/31 passed; corrected 33 passed. Unsafe remote-admission mutant: 4 failed/29 passed, including actual HTTP200 sentinel overwrites; restored 33 passed. Proof.
• Initial base 5a containment proof: 4 failed/23 passed ->corrected 27 passed. Evidence.
• Fresh independent Terra source review found no concrete regressions. Full formatting/build passed. CI and PR reviews remain pending; the earlier Apple lane was cancelled. No live-device run is required for this host-side change. General symlink containment remains outside scope.