feat: session ids — a scoped withSession() plus an init-level default

[PabloPardoGarcia]

TypeScript twin of glassflow/rius-sdk-python#61 — same surface, same wire contract: the caller mints a session id and the SDK stamps it as OpenInference session.id on every span, which the sink reads into the first-class SessionId column, falling back to TraceId when absent.

API

// a server handling many sessions: scope each turn
await withSession(conversationId, async () => {
  await handleTurn(message)
})

// no id of your own? the scope mints a UUID and hands it to the callback
await withSession(async (sessionId) => { ... })

// one-run-per-process agents: a process-wide default
init({ sessionId })   // or RIUS_SESSION_ID

The scope rides OTel context (nests, unwinds on a throw, follows async continuations), overrides the init-level default, and the innermost scope wins.

Design points

Same as the Python PR, condensed: stamped on every span at onStart by a span processor (the sink derives per-span with a TraceId fallback, and pending snapshots are built at start from the identity allowlist, which session.id joins); session.id only, not gen_ai.conversation.id; no process-wide auto-generation — a generated id exists only inside an explicit scope. The processor is added before the pending processor so the snapshot sees the attribute.

The semconv parity fixture is regenerated from the Python branch (19 constants, +SESSION_ID), so the parity workflow stays green when both PRs land. Merge order: the Python PR first — this fixture asserts a constant Python main doesn't have yet.

12 new tests (scoping, nesting, UUID minting + callback handoff, return passthrough, init default + env var, override precedence, pending snapshot); 220 passing, typecheck/lint/build clean.