fix: greedy regex in validate-commands captures all refs per line, add 18 tests

The command cross-reference regex /^.*`\/(...)`.*$/gm only captured the
LAST command ref per line due to greedy .* consuming earlier refs.
Replaced with line-by-line processing using non-anchored regex to
capture ALL command references.

New tests:
- 4 validate-commands multi-ref-per-line tests (regression)
- 8 evaluate-session threshold boundary tests (new file)
- 6 session-aliases edge case tests (cleanup, rename, path matching)

scripts/ci/validate-commands.js

@@ -74,14 +74,17 @@ function validateCommands() {
 
     // Check cross-references to other commands (e.g., `/build-fix`)
     // Skip lines that describe hypothetical output (e.g., "→ Creates: `/new-table`")
-    const cmdRefs = contentNoCodeBlocks.matchAll(/^.*`\/([a-z][-a-z0-9]*)`.*$/gm);
-    for (const match of cmdRefs) {
-      const line = match[0];
+    // Process line-by-line so ALL command refs per line are captured
+    // (previous anchored regex /^.*`\/...`.*$/gm only matched the last ref per line)
+    for (const line of contentNoCodeBlocks.split('\n')) {
       if (/creates:|would create:/i.test(line)) continue;
-      const refName = match[1];
-      if (!validCommands.has(refName)) {
-        console.error(`ERROR: ${file} - references non-existent command /${refName}`);
-        hasErrors = true;
+      const lineRefs = line.matchAll(/`\/([a-z][-a-z0-9]*)`/g);
+      for (const match of lineRefs) {
+        const refName = match[1];
+        if (!validCommands.has(refName)) {
+          console.error(`ERROR: ${file} - references non-existent command /${refName}`);
+          hasErrors = true;
+        }
       }
     }