feat(minimald): support sftp to session filesystem - #267

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/minimald/src/sftp.rs`:
- Around line 120-136: The resolve method currently uses candidate.absolutize()
which only performs lexical normalization and thus allows escaping via in-tree
symlinks; replace that with a real filesystem canonicalization
(std::fs::canonicalize) so symlinks are resolved and the comparison is performed
against the canonicalized workspace path (which you should canonicalize once or
ensure canonicalized before comparing). Update resolve to canonicalize the
candidate path and the workspace (or use a pre-canonicalized self.workspace),
map canonicalize errors to SftpError::Io (same as current mapping), and then
check starts_with against the canonical workspace, returning
SftpError::PathTraversal if it escapes.
- Around line 247-262: The server is allocating buf of size len directly from
the client in async fn read which lets a malicious client request enormous
allocations; introduce a sane maximum (e.g. const MAX_READ_BYTES) and clamp the
requested length before allocation (let cap = std::cmp::min(len as usize,
MAX_READ_BYTES)), allocate buf with cap, perform the read into that buffer,
truncate to the number of bytes read, and return Data { id, data: buf };
preserve the existing EOF handling (return Err(SftpError::Eof) when n == 0).

In `@crates/sessions/src/lib.rs`:
- Around line 22-23: The Record struct currently uses #[serde(default =
"Uuid::nil")] pub id: Uuid which causes missing legacy ids to become Uuid::nil()
and break ID-based lookup; change the deserialization strategy to treat the id
as optional (e.g., #[serde(default)] pub id: Option<Uuid>) and, in the
load/migration path that reads persisted records (the code that
constructs/returns Record instances used by List and GetRecord), detect missing
id and backfill it with a real id (Uuid::new_v4())—store or persist the updated
Record if appropriate so subsequent lookups work; update call sites that read
record.id to handle Option (or normalize to non-Option after backfill) to
restore correct ID-based lookup behavior.

In `@crates/sessions/src/store.rs`:
- Around line 110-114: DiskLoader::new currently assumes the on-disk index
deserializes to the new Index struct (with short_to_uuid and name_to_uuid) which
breaks upgrades from the old shape (a bare BTreeMap<String,Uuid>); change
DiskLoader::new to first attempt deserializing the file as Index, and if that
fails, attempt deserializing the old BTreeMap<String,Uuid> shape, then build a
new Index by setting short_to_uuid from that map and reconstructing name_to_uuid
by scanning each session's record.json (using each session's stored name) in the
sessions directory (or vice versa), inserting entries into name_to_uuid while
handling duplicates consistently with current rules; after reconstruction,
overwrite the on-disk index with the new Index format so future loads succeed
and proceed normally.

---

Nitpick comments:
In `@crates/minimald/src/sftp.rs`:
- Around line 278-312: opendir currently eagerly reads the whole directory into
a Vec<File>, bypassing READDIR_BATCH; change OpenHandle::Dir to store a
tokio::fs::ReadDir (and any queued leading entries like "." and optional "..")
instead of Vec<File>, have opendir create and mint an OpenHandle::Dir containing
the ReadDir and the precomputed "."/".." entries, and update readdir to consume
up to READDIR_BATCH entries by repeatedly calling ReadDir::next_entry().await to
produce File values on demand, draining queued leading entries first and
returning SftpError::Eof only when both the queue and the ReadDir are exhausted;
update mint_handle/dir_mut usage to match the new OpenHandle::Dir shape.

In `@crates/minimald/src/test_harness.rs`:
- Line 151: The test uses a hardcoded subsystem string in
channel.request_subsystem(true, "sftp").await.unwrap(); — replace the literal
"sftp" with the subsystem name constant crate::sftp::SUBSYSTEM_NAME to keep
tests consistent with the production dispatch logic; update the call to use
crate::sftp::SUBSYSTEM_NAME wherever channel.request_subsystem is invoked in
this test (referencing the channel.request_subsystem function and the
crate::sftp::SUBSYSTEM_NAME constant).