Select a live GitHub session cookie across multiple browser stores

[drogers0]

Problem

cookies.GetGitHubSession read every user_session cookie across all browsers/profiles via kooky (filtered only by expiry) and returned cookies[0] — the first in kooky's nondeterministic store-discovery order. When more than one cookie store holds an unexpired user_session (multiple profiles in any browser, multiple browsers installed, or Firefox containers — not Firefox-specific), a stale/logged-out cookie can win. It passes expiry checks but fails on use: the repo page returns no uploadToken; check-token returns 302.

Closes #15.

Change

Selection now:

1. Gathers all user_session candidates with per-store identity (FilePath() + Container), scoped to host-only github.com.
2. Prefers candidates whose same store has logged_in=yes (GitHub sets it on login, removes it on logout) — a free, local, browser-agnostic signal that alone fixes the reported scenario.
3. Validates only to disambiguate: with a single candidate it's used as-is (if dead, the upload fails the same as before — a request buys nothing); with 2+ logged-in candidates it validates against GitHub and takes the first live one. This closes the server-side-revocation gap that logged_in=yes can't catch.

It's a picker, not a gate: if validation is inconclusive (all fail, or offline), it returns the first candidate (by store key) and lets the caller surface the authoritative error. check-token remains the explicit validity gate.

Validation is injected (validate func(*http.Cookie) error) because internal/session imports internal/cookies, so cookies can't import session. extract-token passes nil to stay offline.

Notes

• --token / GH_SESSION_TOKEN bypass GetGitHubSession entirely and are unaffected.
• Selection deliberately ignores cookie recency: kooky derives Creation from the SQLite rowid on the Chromium family (a real cookie's creation reads back as the year 2185), so it's a false signal. Candidates are ordered by store key alone — deterministic across kooky's nondeterministic discovery order — and validation, not recency, chooses among multiple live candidates.
• Out of scope (noted on the issue): a --browser/--profile flag, a multi-account warning, and a clearer logged-out error message.

Tests

Adds internal/cookies/cookies_test.go (the package's first cookie tests) over a pure, kooky-free core — real structs + a stub validator func, no kooky/HTTP mocks. Covers the #15 regression, cross-store correlation guard, subdomain exclusion, logged_in value handling, and the full selectSession decision matrix (single-skips-validation, short-circuit, fall-through, all-dead fallback, determinism). go build/vet, go test -race -cover ./... all pass.

Verified end-to-end against real browser cookies: logged_in is read from a live Chrome store, the per-store correlation works, and check-token resolves + validates the session.