fix(sessions): resolve the held-store scan path from the store resolver, not the db object

The admission gate read `db.db_path`, which made the refusal depend on whatever object
`SessionDB` resolved to; the CLI tests substitute a lightweight double and CI went red with
AttributeError: 'FakeDB' object has no attribute 'db_path'. The path now comes from
`_default_db_path()` — the exact resolver `SessionDB()` itself uses two lines above — so the
scan targets the same file in production and stays reachable regardless of the db object.

hermes_cli/sessions_cmd.py

@@ -1031,7 +1031,8 @@ def cmd_sessions(args, sessions_parser=None):
             return
         if action in _HELD_STORE_ACTIONS and not getattr(args, "dry_run", False) and not getattr(args, "force", False):
             from hermes_state_holders import held_store_refusal
-            refusal = held_store_refusal(db.db_path, command=action)
+            # Same resolver the SessionDB above opened, so the scan never depends on the db object.
+            refusal = held_store_refusal(_default_db_path(), command=action)
             if refusal:
                 print(refusal)
                 return 1