Extends the session-identity fix from v5.11.52 to the places that write.
run_verbosity_steer was one of about ten sites that fall back to _find_current_session_jsonl(), which returns the most recently active transcript. v5.11.52 guarded the site that talks to users; this release closes the rest of the class where it matters most:
compact_capture already accepted a session_id and ignored it when resolving the transcript. It stores checkpoints that are later restored into a model's context, so resolving the wrong session injected another session's content — not merely a wrong number.
quality_cache guessed, then wrote the current session's score into whatever cache that guess resolved to. Its hook caller read transcript_path from the payload and dropped the session_id sitting right next to it.
Both now resolve by identity before falling back to the modification-time guess, matching the order checkpoint_trigger already used.
Also in this release: openclaw/bun.lock is now tracked (every other subpackage tracks its lockfile), and the test and release workflows moved off Node-20 actions.