feat(harness): allow passing caller-owned `sandboxSession` to `HarnessAgent.createSession()` (#19053)