Sanitize a session ID for safe use in filenames and socket paths.
Rejects path separators, .., and non-printable characters.
Returns the sanitized string (replaces unsafe chars with _).
Returns the Unix domain socket path for a session.
Sockets live in the registry dir — $SYNAPS_RUNTIME_DIR when set (e.g.
/run/user/<uid>/synaps), otherwise $SYNAPS_BASE_DIR/run (default
~/.synaps-cli/run/) — which is user-owned and mode 0700, avoiding /tmp
symlink squatting and TOCTOU races.