Creates the store over root (the shared sessions root; the
heartbeats live in a .presence subdirectory that never collides
with the cwd-encoded session folders). now and staleAfter are
injectable for tests.
The fresh presence records, keyed by session id. Stale entries
(their touchedAt older than the store's staleness window) are
treated as dead and never returned.
How old a heartbeat file may get before list() deletes it
(gh-1660): long enough that a suspended process (laptop sleep)
still finds its file to resume heartbeating, short enough that
crash/kill -9 garbage stays bounded. A file with a live pid is
never deleted, whatever its age.