fix: isolate sessions by header cwd

[dangzitou]

Summary

• Filter current-project session listing and --continue by the session header's actual cwd, even in a default encoded directory. This prevents two paths such as project-a and project/a from selecting each other's sessions.
• Add a regression check for both native and Step session managers, including the cross-project append case.
• Limit coding-agent test workers to two and allow the existing 12 MB feedback redaction stress test 90 seconds on slower hosts; its assertions are unchanged.

Fixes #156.

Verification

• Reproduced the bug in five independent runs before the fix.
• npm run check
• ./test.sh