A logical authentication context bound to a subject. Producers and consumers
exchange Session-shaped data in challenge issuance, authentication responses, and
introspection (whoami).
Vendor-namespaced extension object per SPEC.md ยง4.5.1. Each immediate key MUST be a
reverse-DNS namespace; structure under each namespace is opaque to the framework.