Why: review M1 - the slash-joined tenant/project/session identity could
collide for identifiers containing slashes and bind two scopes to one
transcript.
Evidence: collision regression test passes; legacy slash-free scopes
keep their identity encoding (verify-min-native.json, exit=0).
Impact: identity encoding only; transcript filenames for slash-free
scopes unchanged.
Refs: feature/audit-review-minors-cleanup