fix(session-start): support ECC_SESSION_RETENTION_DAYS opt-out + document env var (#2151) (#2163)

* fix(session-start): support ECC_SESSION_RETENTION_DAYS opt-out + document env var

The retention pass for *-session.tmp files (issue #2151) landed previously,
but the env var that controls it was undocumented in the README and rejected
falsy values (0, off, disabled), silently falling back to the 30-day default.
Users who want to keep all sessions for forensic or research workflows had no
way to opt out.

This patch:

- Extends getSessionRetentionDays() so 0|off|false|disabled|never|none disables
  pruning entirely (returns null sentinel; default behavior unchanged).
- Updates the call site in main() to skip pruneExpiredSessions when retention
  is null and emits a clear "[SessionStart] Pruning disabled via
  ECC_SESSION_RETENTION_DAYS" log line so the operator can tell pruning is off.
- Documents ECC_SESSION_RETENTION_DAYS in the README "Hook Runtime Controls"
  section alongside the other ECC_SESSION_* knobs.
- Adds three regression tests in tests/hooks/hooks.test.js covering opt-out
  via 0, opt-out via off, and garbage-value fallback to default 30.

Verification:
- node tests/hooks/hooks.test.js  — 240/240 green (incl. 3 new retention tests)
- node tests/run-all.js           — 2622/2622 green
- npx eslint scripts/hooks/session-start.js tests/hooks/hooks.test.js — clean
- node scripts/ci/validate-no-personal-paths.js — clean
- node scripts/ci/check-unicode-safety.js       — clean
- node scripts/ci/validate-hooks.js — 28 matchers validated
- node scripts/ci/validate-rules.js — 115 files validated

Fixes #2151

* docs(readme): list all ECC_SESSION_RETENTION_DAYS opt-out values + add Windows example

Address reviewer feedback on PR #2163:
- CodeRabbit and cubic both flagged that the README docs only listed 3 of 6
  opt-out values accepted by getSessionRetentionDays() (0, off, disabled),
  while the implementation also accepts false, never, none.
- cubic also flagged the missing Windows PowerShell example for the new
  variable, breaking the parallel structure of the existing
  ECC_CONTEXT_MONITOR_COST_WARNINGS example block.

Updated the README to:
- Spell out all six opt-out values (0, off, false, disabled, never, none)
  and clarify they "keep all sessions (disable pruning)".
- Add an ECC_SESSION_RETENTION_DAYS line to the Windows PowerShell example.

No behavior change. README only.

Verification:
- npx markdownlint README.md — clean
- npx eslint scripts/hooks/session-start.js tests/hooks/hooks.test.js — clean

tests/hooks/hooks.test.js

@@ -5006,6 +5006,103 @@ async function runTests() {
     passed++;
   else failed++;
 
+  if (
+    await asyncTest('disables pruning when ECC_SESSION_RETENTION_DAYS=0', async () => {
+      const isoHome = path.join(os.tmpdir(), `ecc-start-prune-off-${Date.now()}`);
+      const sessionsDir = getCanonicalSessionsDir(isoHome);
+      fs.mkdirSync(sessionsDir, { recursive: true });
+      fs.mkdirSync(path.join(isoHome, '.claude', 'skills', 'learned'), { recursive: true });
+
+      const expiredFile = path.join(sessionsDir, '2026-01-01-keepme-session.tmp');
+      fs.writeFileSync(expiredFile, '# Old Session\n\nSHOULD STILL EXIST');
+      const ninetyDaysAgo = new Date(Date.now() - 90 * 24 * 60 * 60 * 1000);
+      fs.utimesSync(expiredFile, ninetyDaysAgo, ninetyDaysAgo);
+
+      try {
+        const result = await runScript(path.join(scriptsDir, 'session-start.js'), '', {
+          HOME: isoHome,
+          USERPROFILE: isoHome,
+          ECC_SESSION_RETENTION_DAYS: '0',
+        });
+
+        assert.strictEqual(result.code, 0);
+        assert.ok(fs.existsSync(expiredFile), 'Should keep all sessions when retention is opt-out=0');
+        assert.ok(result.stderr.includes('Pruning disabled via ECC_SESSION_RETENTION_DAYS'),
+          `Should log pruning disabled, stderr: ${result.stderr}`);
+        assert.ok(!result.stderr.includes('Pruned'), `Should not log any pruning, stderr: ${result.stderr}`);
+      } finally {
+        fs.rmSync(isoHome, { recursive: true, force: true });
+      }
+    })
+  )
+    passed++;
+  else failed++;
+
+  if (
+    await asyncTest('disables pruning when ECC_SESSION_RETENTION_DAYS=off', async () => {
+      const isoHome = path.join(os.tmpdir(), `ecc-start-prune-offstr-${Date.now()}`);
+      const sessionsDir = getCanonicalSessionsDir(isoHome);
+      fs.mkdirSync(sessionsDir, { recursive: true });
+      fs.mkdirSync(path.join(isoHome, '.claude', 'skills', 'learned'), { recursive: true });
+
+      const expiredFile = path.join(sessionsDir, '2025-12-15-keepme-session.tmp');
+      fs.writeFileSync(expiredFile, '# Forensic Session\n\nKEEP ME');
+      const sixtyDaysAgo = new Date(Date.now() - 60 * 24 * 60 * 60 * 1000);
+      fs.utimesSync(expiredFile, sixtyDaysAgo, sixtyDaysAgo);
+
+      try {
+        const result = await runScript(path.join(scriptsDir, 'session-start.js'), '', {
+          HOME: isoHome,
+          USERPROFILE: isoHome,
+          ECC_SESSION_RETENTION_DAYS: 'off',
+        });
+
+        assert.strictEqual(result.code, 0);
+        assert.ok(fs.existsSync(expiredFile), 'Should keep all sessions when retention is opt-out=off');
+        assert.ok(result.stderr.includes('Pruning disabled via ECC_SESSION_RETENTION_DAYS'),
+          `Should log pruning disabled, stderr: ${result.stderr}`);
+      } finally {
+        fs.rmSync(isoHome, { recursive: true, force: true });
+      }
+    })
+  )
+    passed++;
+  else failed++;
+
+  if (
+    await asyncTest('falls back to default retention when ECC_SESSION_RETENTION_DAYS is garbage', async () => {
+      const isoHome = path.join(os.tmpdir(), `ecc-start-prune-garbage-${Date.now()}`);
+      const sessionsDir = getCanonicalSessionsDir(isoHome);
+      fs.mkdirSync(sessionsDir, { recursive: true });
+      fs.mkdirSync(path.join(isoHome, '.claude', 'skills', 'learned'), { recursive: true });
+
+      const expiredFile = path.join(sessionsDir, '2026-01-01-pruneme-session.tmp');
+      fs.writeFileSync(expiredFile, '# Old Session\n\nDELETE ME');
+      const fortyDaysAgo = new Date(Date.now() - 40 * 24 * 60 * 60 * 1000);
+      fs.utimesSync(expiredFile, fortyDaysAgo, fortyDaysAgo);
+
+      try {
+        const result = await runScript(path.join(scriptsDir, 'session-start.js'), '', {
+          HOME: isoHome,
+          USERPROFILE: isoHome,
+          ECC_SESSION_RETENTION_DAYS: 'bogus-value',
+        });
+
+        assert.strictEqual(result.code, 0);
+        assert.ok(!fs.existsSync(expiredFile),
+          'Should fall back to default 30-day retention and prune the 40-day-old file');
+        assert.ok(result.stderr.includes('Pruned 1 expired session'),
+          `Should log pruning at default retention, stderr: ${result.stderr}`);
+        assert.ok(!result.stderr.includes('Pruning disabled'),
+          'Should NOT treat garbage as opt-out');
+      } finally {
+        fs.rmSync(isoHome, { recursive: true, force: true });
+      }
+    })
+  )
+    passed++;
+  else failed++;
+
   console.log('\nRound 55: session-start.js (newest session selection):');
 
   if (