fix(#2450): CRLF-tolerant session-section rewrite + no-op-detection guard (#2482)

* fix(#2444): re-resolve body-parser to 2.3.0 in lockfile (GHSA-v422-hmwv-36x6)

GHSA-v422-hmwv-36x6 (body-parser DoS via invalid limit value, low severity,
published 2026-07-20T23:23:26Z) made tests/npm-integrity-gate.test.cjs
(#3588: root workspace production tree has no advisories) fail any subsequent
npm audit --omit=dev. The advisory affects body-parser >=2.0.0 <2.3.0 pulled
transitively via @anthropic-ai/claude-agent-sdk -> @modelcontextprotocol/sdk
-> express -> body-parser@2.2.2.

express@5.2.1 already declares body-parser as ^2.2.1, so 2.3.0 is a valid
re-resolution within express's own compatibility range — no override needed.
Regenerated the lockfile via 'npm audit fix --omit=dev' which re-resolves
transitive deps within their declared ranges; package.json is unchanged.

Verified: npm audit --omit=dev reports 0/0/0/0/0 advisories; body-parser
now reads as 2.3.0 in 'npm ls body-parser --omit=dev'.

* test(#2450): failing-first CRLF regression for record-session insert path

cmdStateRecordSession's section-rewrite regexes (src/state.cts:1166,
:1195) used literal \\n which cannot match CRLF STATE.md delimiters.
The detector regex (CRLF-tolerant via $ under /m) entered the rewrite
branch, the writer regex silently no-op'd, but updated.push(...)/
sessionCreated=true ran unconditionally. Result: caller reported
recorded:true with 'Resume File' in updated, but the field was never
written to disk. With core.autocrlf=input, the CRLF working-tree file
produces no git diff, so the bug was invisible.

Adds three regression tests covering all three rewrite paths:
- CRLF STATE.md with ## Session and Resume file absent
- CRLF STATE.md with ## Session and Stopped at absent
- CRLF STATE.md with ## Session Continuity (bootstrap shape)

Each asserts the field IS on disk (the bug discriminator: the pre-fix
command's JSON output looked identical to a successful write).

* fix(#2450): CRLF-tolerant session-section rewrite + no-op-detection guard

Two regexes in cmdStateRecordSession used literal \\n which cannot match
CRLF STATE.md, silently no-op'ing the section rewrite while the CRLF-
tolerant detector above entered the branch. The reporter's exact repro:
on a CRLF STATE.md with one canonical session field absent, the command
returned recorded:true + updated:['Resume File'] but the field was never
written to disk.

Three changes:

1. src/state.cts:1166 (canonical ## Session rewrite regex): \\n -> \\r?\\n
2. src/state.cts:1195 (## Session Continuity insert regex): \\n -> \\r?\\n
3. Defensive invariant (#2450 class fix per reporter's suggestion): track
   whether the chosen branch's replace actually matched via callback flag.
   Only set sessionCreated=true and push to updated when rewriteMatched.
   Unreachable post-fix, but fail-loud is the right posture for a silent-
   success gate. If a future drift between the detector and writer regexes
   reintroduces the asymmetry, the caller will not see false updated entries.

Same canonical CRLF-tolerant form already in use at check-command-router.cts
:205 (extractPlanDesignatedSections). Same bug class previously fixed in
#1658, #1668, #2206, #2449.

* fix(#2450): address review followups + add changeset

Code-review + security-review both flagged the unreachable else at the
Session Continuity branch (defaulted rewriteMatched=true in dead code,
re-arming the bug class for future drift). Removed the else; the
remaining code path leaves rewriteMatched=false if linesToInsert is
empty, preserving the fail-loud posture.

Added scope-limitation doc to the rewriteMatched gate: it covers the
INSERT path only, not the earlier in-place stateReplaceField successes
(which DID land on disk and correctly push to updated unconditionally).

Tests:
- Normalized STATE_CRLF_SESSION_MISSING_RESUME fixture to match the
  canonical 6-key frontmatter of STATE_WITH_SESSION (code-review I2).
- Added mixed-ending test (LF frontmatter + CRLF body) to close
  CONTRIBUTING.md:490 'Mixed CRLF/LF newlines' requirement (I1).

Added Fixed changeset (code-review H1).

* docs(changeset): backfill PR number to 2482

.changeset/eight-foxes-cheer.md

@@ -0,0 +1,5 @@
+---
+type: Fixed
+pr: 2482
+---
+**`state record-session` no longer silently drops inserted fields on a CRLF `STATE.md`** — the section-rewrite regexes in `cmdStateRecordSession` used literal `\n` which couldn't match a CRLF STATE.md (`---\r\n`), so when a canonical session field (`Resume file` / `Stopped at` / `Last session`) was missing and had to be **inserted** via the section-rewrite path, the CRLF-tolerant detector entered the branch, the writer regex silently no-op'd, but `updated.push(...)` ran unconditionally. The command returned `{"recorded": true, "updated": ["Resume File"]}` while the field was never written to disk. With `core.autocrlf=input`, the CRLF working-tree file produced no `git diff`/`git status` change, so the bug was invisible. Both regexes now use the CRLF-tolerant `\r?\n` form (same canonical pattern already in use elsewhere), and a new defensive invariant gates `updated.push(...)` on the replace callback actually firing — so a future detector/writer drift will surface as missing `updated` entries rather than re-arming this silent-success class.