test(session): target the admitted request header in spill replay

Synchronous admission finalization moves the first request/header to seq10 before the deferred title. Read that actual header rather than seq11 request/context so the spill scenario exercises a large canonical request record. Keep the inherited dynamic-locator verification and independent file-content oracle; the test now requires a real successful read and SPILL_CANONICAL_OK rather than recording shell failure.

Validation: targeted built refresh and subsequent read-only replay both pass with complete spilled JSON equal to the live request/header and the session_event_search schema present.

snapshots/session/session-query-spill/replay.override.json

@@ -3,8 +3,8 @@
     "kind": "chunks",
     "chunks": [
       { "type": "block-start", "index": 0, "blockType": "tool-call" },
-      { "type": "tool-call-delta", "index": 0, "id": "call_session_query_spill", "name": "session_event_read", "argumentsDelta": "{\"seq\":11}" },
-      { "type": "block-end", "index": 0, "block": { "type": "tool-call", "id": "call_session_query_spill", "name": "session_event_read", "arguments": "{\"seq\":11}" } },
+      { "type": "tool-call-delta", "index": 0, "id": "call_session_query_spill", "name": "session_event_read", "argumentsDelta": "{\"seq\":10}" },
+      { "type": "block-end", "index": 0, "block": { "type": "tool-call", "id": "call_session_query_spill", "name": "session_event_read", "arguments": "{\"seq\":10}" } },
       { "type": "usage", "usage": { "inputTokens": 10, "outputTokens": 5 } },
       { "type": "finish", "reason": { "kind": "tool-calls" } }
     ]