fix(security): sanitize session bootstrap failures

frontend/src/shell/AppShell.session-mgmt.test.tsx

@@ -68,6 +68,9 @@ test("Archive accordion expands to reveal archived sessions", async () => {
 
 test("Resume from the panel activates the session and closes the panel", async () => {
   let resumed: string | null = null;
+  useSessionStore.setState({
+    activityLog: [{ kind: "status", phase: "F7", text: "Stale prior activity", level: "info" }],
+  });
   server.use(
     http.post("http://localhost:8787/sessions/:id/resume", ({ params }) => {
       resumed = params.id as string;
@@ -78,11 +81,9 @@ test("Resume from the panel activates the session and closes the panel", async (
   await userEvent.click(await screen.findByText("Attiva uno"));
   await screen.findByText("Domanda originale"); // panel open
   await userEvent.click(screen.getByRole("button", { name: /resume/i }));
-  expect(useSessionStore.getState().activityLog).toContainEqual({
-    kind: "lifecycle",
-    phase: null,
-    text: "Resuming session",
-  });
+  expect(useSessionStore.getState().activityLog).toEqual([
+    { kind: "lifecycle", phase: null, text: "Resuming session" },
+  ]);
   await waitFor(() => expect(resumed).toBe("s1"));
   await waitFor(() => expect(screen.queryByText("Domanda originale")).not.toBeInTheDocument()); // panel closed
 });
@@ -230,7 +231,7 @@ test("closing and reopening Model activity preserves the complete activity log",
     });
     store.applyEvent({ type: "text_delta", text: "Cohort ready" });
   });
-  const beforeClose = useSessionStore.getState().activityLog;
+  const beforeClose = useSessionStore.getState().activityLog.map((entry) => ({ ...entry }));
 
   expect(screen.queryByRole("heading", { name: /model activity/i })).not.toBeInTheDocument();
   await userEvent.click(screen.getByRole("button", { name: /model activity/i }));