Deepen Desktop evidence snapshots

Traceability

• Spec ID: rust-evidence-host-snapshot-depth
• Status: Implemented
• Follows: docs/specs/2026-09-08-rust-evidence-host-remaining-adapters.md

Intent

The remaining-adapter slice found every host, but several real Desktop sessions still disappear or leak private text: compressed DSH artifacts, Pi custom session directories, forked Pi transcripts that double-count a parent, and retained prompts/tool detail that still carry credentials. Deepen the existing snapshot — do not port the JS analyzers.

Acceptance Scenarios

• AC-1: A workspace-qualified DSH session.jsonl.zstd is discovered when no uncompressed session.jsonl is present. Decode failure omits that artifact. Both files in one session directory are omitted as ambiguous.
• AC-2: Pi discovery honors PI_CODING_AGENT_SESSION_DIR, then