Sanitize a session ID for safe use in filenames and socket paths.
Rejects path separators, .., and non-printable characters.
Returns the sanitized string (replaces unsafe chars with _).
Returns the Unix domain socket path for a session.
Sockets live in the registry dir (~/.synaps-cli/run/) which is user-owned
and mode 0700, avoiding /tmp symlink squatting and TOCTOU races.