feat(sessions): Add composability/resolution to loadouts - #348

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/paths/src/lib.rs`:
- Around line 200-207: The constructors AbsPath::new_unchecked and
RelPath::new_unchecked currently are public and only use debug_assert! to check
inner.is_absolute()/inner.is_relative(), allowing invalid values in release
builds; fix this by making them either non-public (change signature to
pub(crate) fn new_unchecked(...)) or mark them explicitly unsafe (pub unsafe fn
new_unchecked(...)) and add a clear # Safety doc comment plus the required //
SAFETY: comment per repo standards describing the caller responsibility to
ensure the path invariant (absolute for AbsPath, relative for RelPath); update
both functions (new_unchecked) accordingly so the invariant is enforced by the
type system rather than only debug assertions.

In `@crates/sessions/docs/RESOLUTION.md`:
- Line 13: Update the documentation to use the current API names: replace
occurrences of Composable::compose_into(&mut Composer) with
Composable::contribute(...) and update references to Composer::add/add_all where
appropriate; also update the resolve signature block to reflect the new
Contribute/Composer method names so examples and docs consistently reference
Composable::contribute and Composer::add/add_all instead of the old
compose_into/Composer naming.
- Line 7: The fenced code block opened on line 7 lacks a language tag (triggers
markdownlint MD040); update the opening fence in RESOLUTION.md (the triple
backtick block) to include a language identifier such as ```text (or another
appropriate language) so the fenced block becomes ```text and resolves the
linter warning.

In `@crates/sessions/src/vars.rs`:
- Around line 507-512: Change build_set to return Result<GlobSet, Error> instead
of unwrapping: replace the call to GlobSetBuilder::build().expect(...) with
b.build().map_err(|e| Error::GlobSetBuild(e.into()))? (or add a new
Error::GlobSetBuild(globset::Error) variant and map accordingly). Update callers
(try_new and with_pattern) to propagate the Result using ? and adapt their
signatures to return Result where needed, and add the new Error enum variant
mapping globset::Error into your crate's Error type so build failures are
returned as typed errors rather than panicking.

---

Nitpick comments:
In `@crates/sessions/src/composable.rs`:
- Around line 467-479: Add Rustdoc comments to the PolicyHooks trait and both
methods (PolicyHooks, on_var_unapproved, on_patch_unapproved) describing purpose
and expected behavior, explain each parameter (policy: VarsPolicy/PatchPolicy
and items: &[Unapproved<...>]) including what the Unapproved item represents,
and document the return type HookResult<VarsPolicy>/HookResult<PatchPolicy>
semantics (e.g., whether Ok means accept/modify policy, Err aborts processing,
any side effects). Keep docs concise, include example usage or panics only if
relevant, and ensure doc comments appear above the trait and each method
signature.

In `@crates/sessions/src/patches.rs`:
- Around line 683-702: The check method currently returns
CheckOutcome::Decided(Decision::Ignored) and drops the provided item when
filesets_match(&self.ignore, path) is true, which is inconsistent with
Denied/Allowed branches that preserve the item; update the ignore branch in
check (function name: check, type: impl for patches) to return the provenance
with the ignored decision (e.g., CheckOutcome::Decided(Decision::Ignored(item)))
so callers can still access item metadata for logging/diagnostics, ensuring the
other branches (Denied/Allowed) remain unchanged and still use
filesets_match(&self.deny, path) and filesets_match(&self.allow, path).
- Around line 184-197: The walk_root implementation incorrectly treats escaped
glob metacharacters as active; update walk_root to skip characters that are
escaped by a backslash: when iterating pattern.bytes().enumerate() inside
walk_root, if you see a backslash (b'\\') treat the next byte as literal by
advancing/skipping the subsequent byte in the loop (so escaped '*', '?', '[',
'{' are ignored for triggering the glob handling), then continue the existing
logic to record last_slash and return HostPath::new(...) as before; ensure this
uses the same pattern() value and preserves behavior when the backslash is the
final byte.