Allow omitted or empty session directory metadata in cloud sync

[joan-byte]

🔍 Problem Description

Legacy sessions can retain valid session identities and useful linked observations/prompts while lacking filesystem directory metadata. Cloud sync currently rejects such sessions. The exporter includes parent sessions needed by dependent records, so excluding an explicit session journal entry alone does not remove that dependency.

The local-import changes in #1287/#1298 intentionally retain strict cloud validation. This is a request to extend compatibility, not a report that their local-only fix regressed.

💡 Proposed Solution

Support omitted or string-valued session directory metadata consistently across cloud client canonicalization, server validation, and cloud import.

Acceptance criteria:

• Accept omitted directory, empty strings, whitespace-only strings, and concrete string paths.
• Reject explicit null, numbers, arrays, objects, and other non-string values.
• Preserve session identity/entity-key consistency, project authorization, referential closure, and atomic import guarantees.
• Preserve existing concrete directory metadata when later incoming metadata is empty; allow later concrete metadata to complete a legacy session.
• Include regression tests for push validation and cloud import of a legacy session with linked observations/prompts, plus invalid-type and authorization/reference rejection tests.
• Document server-first then client rollout; old strict servers/clients remain incompatible with these payloads.

Do not invent directory paths, delete memories, or weaken identity and authorization checks to obtain compatibility.

📦 Affected Area

Sync (multi-instance)

🔄 Alternatives Considered

Retaining strict validation leaves historical sessions without directory evidence unable to synchronize. Fabricating a directory introduces misleading metadata. Omitting parent sessions risks breaking dependency closure; quarantining only session journal entries does not prevent observation export from including their source parent sessions. Deleting dependent memories sacrifices otherwise useful content.

📎 Additional Context

Related work: #1287 and #1298. The local-import fix is included in inspected commit 3692e1aff0f70a1ef41f0ce3ca7b9f54aad2dc68; comparison with 3eb2832a8e21ae2d97f1a7e2ace0cc86de7d958a showed no changes to the relevant cloud session validation.

Evidence is source inspection and local diagnostics, not a newly executed public cloud reproduction. Relevant implementation areas are internal/cloud/chunkcodec, internal/cloud/cloudserver, internal/store, and the dependency-preserving exporter in internal/sync. This request does not claim to resolve unrelated malformed observation data or enrollment/target configuration.