fix: cross-platform absolute path validation

[josstei]

Summary

• Harden relative-path checks to reject Windows drive, UNC, and rooted absolute paths in addition to POSIX absolutes.
• Apply the same validation logic in session state helpers so filesystem-facing reads and writes stay consistent.
• Add regression coverage for the new path forms in unit tests.

Testing

• Passed focused unit tests for validation and session-state helpers.
• Passed the full npm test suite.