test(session): pin the id '/' ban and the FIFO O_NONBLOCK guard (#169)

PR #170 round-2 review: both guards stayed green when removed. Adds an
ErrInvalidID sentinel, a plain-prefix-then-'..' escape case asserted on
the sentinel, and a no-reader FIFO case with a timeout. Flip-verified:
allowing '/' in the id tail and dropping O_NONBLOCK each turn the suite red.

Refs #169

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ingestion/internal/session/session.go

@@ -49,9 +49,12 @@ type Attempt struct {
 // write (hyperguild#169).
 var idPattern = regexp.MustCompile(`^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$`)
 
+// ErrInvalidID is returned when a session id is not a plain file name.
+var ErrInvalidID = errors.New("session id is not a plain name")
+
 func checkID(sessionID string) error {
 	if !idPattern.MatchString(sessionID) {
-		return fmt.Errorf("session id %q is not a plain name", sessionID)
+		return fmt.Errorf("%w: %q", ErrInvalidID, sessionID)
 	}
 	return nil
 }