fix(core): Guard clearSession with session lock to prevent NPE (#5657)

* fix(core): Guard clearSession with session lock to prevent NPE

clearSession() reset the session field without acquiring sessionLock,
unlike the other session mutators (startSession, endSession,
withSession). This allowed it to null out the session between a
null-check and a dereference (e.g. session.clone()) in those locked
methods, leading to a NullPointerException. Acquire sessionLock so all
session mutations are mutually exclusive.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* changelog

* changelog

* changelog

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>