remove vm session feature

Cuts the daemon-managed guest-session machinery (start/list/show/
logs/stop/kill/attach/send). The feature shipped aimed at agent-
orchestration workflows (programmatic stdin piping into a long-lived
guest process) that aren't driving any concrete user today, and the
~2.3K LOC of daemon surface area — attach bridge, FIFO keepalive,
controller registry, sessionstream framing, SQLite persistence — was
locking in an API we'd have to keep through v0.1.0.

Anything session-flavoured that people actually need today can be
done with `vm ssh + tmux` or `vm run -- cmd`.

Deleted:
- internal/cli/commands_vm_session.go
- internal/daemon/{guest_sessions,session_lifecycle,session_attach,session_stream,session_controller}.go
- internal/daemon/session/ (guest-session helpers package)
- internal/sessionstream/ (framing package)
- internal/daemon/guest_sessions_test.go
- internal/store/guest_session_test.go
- GuestSession* types from internal/{api,model}
- Store UpsertGuestSession/GetGuestSession/ListGuestSessionsByVM/DeleteGuestSession + scanner helpers
- guest.session.* RPC dispatch entries
- 5 CLI session tests, 2 completion tests, 2 printer tests

Extracted:
- ShellQuote + FormatStepError lifted to internal/daemon/workspace/util.go
  (only non-session consumer); workspace package now self-contained
- internal/daemon/guest_ssh.go keeps guestSSHClient + dialGuest +
  waitForGuestSSH — still used by workspace prepare/export
- internal/daemon/fake_firecracker_test.go preserves the test helper
  that used to live in guest_sessions_test.go

Store schema: CREATE TABLE guest_sessions and its column migrations
removed. Existing dev DBs keep an orphan table (harmless, pre-v0.1.0).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/daemon/doc.go

@@ -1,8 +1,8 @@
 // Package daemon hosts the Banger daemon process.
 //
 // The daemon exposes a JSON-RPC endpoint over a Unix socket. It owns VM
-// lifecycle, image management, guest sessions, host networking bootstrap,
-// and state persistence via internal/store.
+// lifecycle, image management, host networking bootstrap, and state
+// persistence via internal/store.
 //
 // The package is organised into cohesive groups. Pure stateless helpers for
 // each group have been lifted into subpackages; orchestrator methods
@@ -18,13 +18,9 @@
 //	internal/daemon/imagemgr   Image subsystem helpers: path validation,
 //	                           artifact staging, guest provisioning script
 //	                           generator, metadata.
-//	internal/daemon/session    Guest-session helpers: state paths, runner
-//	                           / inspect / signal scripts, state snapshot
-//	                           parsing, launch helpers, ShellQuote,
-//	                           FormatStepError.
 //	internal/daemon/workspace  Workspace helpers: git repo inspection,
 //	                           shallow copy prep, guest-side import,
-//	                           finalize script generation.
+//	                           finalize script generation, shell quoting.
 //
 // VM lifecycle (in this package):
 //
@@ -50,11 +46,7 @@
 //
 // Guest interaction (in this package):
 //
-//	guest_sessions.go      dialGuest, waitForGuestSSH, refresh/inspect
-//	session_lifecycle.go   Start/Stop/Kill/Get/List/signal orchestrators
-//	session_attach.go      BeginGuestSessionAttach + bridge/forward/watch
-//	session_stream.go      GuestSessionLogs, SendToGuestSession
-//	session_controller.go  guestSessionController, sessionRegistry
+//	guest_ssh.go           guestSSHClient, dialGuest, waitForGuestSSH
 //	ssh_client_config.go   daemon-managed SSH client key material
 //	workspace.go           ExportVMWorkspace, PrepareVMWorkspace
 //
@@ -73,10 +65,8 @@
 //
 // Lock ordering:
 //
-//	vmLocks[id]  →  {createVMMu, imageOpsMu}  →  subsystem-local locks
+//	vmLocks[id]  →  workspaceLocks[id]  →  {createVMMu, imageOpsMu}  →  subsystem-local locks
 //
-// Subsystem-local locks live on their owning type (tapPool.mu,
-// sessionRegistry.mu, opstate.Registry mu, guestSessionController.attachMu /
-// writeMu) and do not contend with each other. See ARCHITECTURE.md for
-// details.
+// Subsystem-local locks (tapPool.mu, opstate.Registry mu) are leaves and
+// do not contend with each other. See ARCHITECTURE.md for details.
 package daemon