Unify runtime-state session validity across watch and doctor

[LarsCowe]

Describe the bug

The runtime-state consolidation fixed most parser drift, but session validity still is not owned by one shared contract end-to-end.

Today a future-dated .ralph/.ralph_session file is treated differently by different consumers:

• bmalph doctor reports it as invalid timestamp (future)
• bmalph watch still treats it as an active session and renders Session: 0m 0s

That means runtime-state semantics are still split between the shared reader and its callers. The underlying issue is broader than this one payload: we still need one explicit runtime-state contract for semantic validity, plus invariant-style tests that pin the same behavior across state, watch, and doctor.

To reproduce

1. Create a project with a .ralph/.ralph_session file like:

{
  "session_id": "abc-123",
  "created_at": "2099-01-01T00:00:00Z",
  "last_used": "2099-01-01T00:00:00Z"
}

2. Run bmalph doctor
3. Observe Ralph session reported as invalid timestamp (future)
4. Run bmalph watch
5. Observe the dashboard still renders an active session, effectively as Session: 0m 0s

Expected behavior

Runtime-state consumers should agree on the validity of .ralph/.ralph_session.

A future-dated session should not be shown as active in watch if doctor considers it invalid.

More generally, the runtime-state contract should be centralized enough that state/watch/doctor cannot drift on semantic validity rules for runtime files.

Environment

• OS: Windows 11
• Node.js version: 22.x
• bmalph version: 2.7.4
• Shell: PowerShell

Additional context

This should be handled as a global hardening pass, not another one-off edge-case patch.

Suggested scope:

• Move session semantic validity checks that matter to consumers into the shared runtime-state layer, or introduce a shared session classification helper used by both watch and doctor.
• Define one explicit contract for when a session is considered active, invalid, reset, missing, or unreadable.
• Keep caller-specific presentation local, but make the validity decision shared.
• Add matrix tests for .ralph/.ralph_session covering:
  • missing file
  • invalid JSON
  • unreadable file
  • reset payload
  • unparsable created_at
  • future created_at
  • valid active session
• Add end-to-end consumer regressions so watch and doctor stay aligned on the same runtime payloads.

This is the remaining example of the broader runtime-state drift problem that previously surfaced repeatedly in code review.