Restrict semantic variable lookup to session scope

[Yuqing (mydmdm)]

Summary

• prevent the public semantic-variable API from resolving variables in the global constant-prefix namespace
• retain constant-prefix sharing exclusively in internal request-chain and context-cache paths
• add a regression test proving that neither the originating session nor another authenticated session can retrieve a constant prefix by ID through the public lookup path

Scan result coverage

• CWE-639 / Issue 95c40883-b36e-411c-9fe8-b1c4b44e0d6b: fixed. SemanticVariableManager.get_var(session_id, var_id) now resolves only the supplied session's local namespace.
• CWE-352 / Issue 8d430218-3d21-4231-88e8-c17fdc0bdc9a: stale evidence. PR Security hotfix: remediate authentication, code execution, and SSRF findings #16 already changed /register_engine to return 403 without parsing the request or invoking ServeCore. The existing security regression test continues to cover that behavior.

Security impact

Before this change, a caller with a valid session capability and a leaked global constant-prefix var_id could read that prefix through the public semantic-variable endpoint. IDs are not externally derivable and constant prefixes are already filled, which limited exploitability, but identifier secrecy is not an ownership control.

Validation

• focused constant-prefix ownership regression: passed
• dynamic engine registration rejection regression: passed
• complete HTTP security regression file: 6 passed
• changed files compile with py_compile
• git diff --check