fix(peer): log dropped sidecar inbound, correct InstanceRef docs

[androidand]

Follow-up to #93 (8a707c3).

• deliver() now logs (logWarning with session.id + msgID) instead of silently dropping inbound for unmanaged / unknown sessions
• Corrects the InstanceRef comment: SessionStatus.get and SessionPrompt.prompt need one; Session.get reads the global DB. Also notes inbound.sessionID is the sidecar's own owner ID, not sender-controlled, so pre-check instance boot isn't peer-triggerable
• Documents why the status listener's bare session.get is safe (global DB, ensureFor only spawns)
• sidecar-manager: marks Managed.directory immutable, same doc fix

Verified: bun typecheck clean, lifecycle-inject regression passes, full test/peer/ suite 125 pass / 0 fail.

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.