Bind every session through session_scope and start test requests unbound - #563

What changed

session_scope is the one primitive that binds a session, and every place that runs outside a request now uses it.

• step_session returns session_scope(_step_engine()); session_scope yields its session for the callers that need it.
• dispatch() binds its own session wherever it is called. Workflow.__init_subclass__ wraps a declared dispatch() in bound_session(), and the cron tick calls it without a session of its own. The SessionNotBoundError message, which names dispatch() as a bound place, is now true.
• The test harness enters each request as production does: configure_app_for_test installs a boundary that hides the harness session for the request, and the fixture's on-demand session refuses inside one. A read the app never bound now fails in a test the way it fails on the host. The direct verifier test is gone; the wire test covers it. The generic-subjects fixture mounts its fake app through the app, so its routes get the request session like a loaded app's.

The author guide states that dispatch() binds its own session, that a row a step returns is detached, and that a test request starts with no session bound.