feat: harden session lifecycle and export invariants (Fixes #15)

[rosspeili]

Hardens session lifecycle and export invariants (#15):

• Closed session is sealed — double-close, emit-after-close, and duplicate open raise clear errors (SessionClosedError, SessionAlreadyOpenError)
• Atomic export — summary + OTel written to staging paths and committed together; partial failures leave neither artifact updated
• export=False still builds a receipt — run.summary, run.audit_report, and run.conformance populated in memory on context exit
• Open-time baseline frozen — open_snapshot_hash and declared_rules captured at open for conformance; runtime skill binds may still update live rules / snapshot_hash

Fixes #15

Type

• Core framework — session, spine, constraints, identity, audit report
• Documentation

Checklist

• Linked issue (Fixes #15)
• pytest passes (90/90)
• black aura tests — no diff
• flake8 aura tests — clean
• CHANGELOG.md updated when user-visible behavior changes

Test plan

• New tests/test_session_invariants.py — export on/off, double-close, emit-after-close, double-open, identity immutability, snapshot/conformance alignment, atomic export failure
• Full suite green (pytest)
• Docs synced: outputs.md, using-aura.md, concepts.md, getting-started.md