fix: greedy regex in validate-commands captures all refs per line, add 18 tests

The command cross-reference regex /^.*`\/(...)`.*$/gm only captured the
LAST command ref per line due to greedy .* consuming earlier refs.
Replaced with line-by-line processing using non-anchored regex to
capture ALL command references.

New tests:
- 4 validate-commands multi-ref-per-line tests (regression)
- 8 evaluate-session threshold boundary tests (new file)
- 6 session-aliases edge case tests (cleanup, rename, path matching)

tests/run-all.js

@@ -16,6 +16,7 @@ const testFiles = [
   'lib/session-manager.test.js',
   'lib/session-aliases.test.js',
   'hooks/hooks.test.js',
+  'hooks/evaluate-session.test.js',
   'integration/hooks.test.js',
   'ci/validators.test.js',
   'scripts/setup-package-manager.test.js',