[Tom Gamble (gambtho)]

Pin Sessions and its Substrate adapter to v0.3.0, plus Substrate v0.5.0.
Update schema-6 migration checks and upgrade notes.
Substrate needs a fresh-state reinstall; Canvas runtime and auth policies are unchanged.

Verified: full Canvas race shards, remaining Go race suite (-p 1), vet, JS, Python, build and browser smoke.
An initial parallel Go run hit a harness-readiness timeout; isolated and serial checks passed.
No live model or cluster qualification.

[Copilot]

🔵 Needs a closer look

The one-way journal migration and fresh-state Substrate reinstall require human review of rollout and recovery requirements beyond the reported local verification.

No open issues 🎉

What changed in this PR

Pins Canvas to Sessions and its Substrate adapter v0.3.0 and Substrate v0.5.0, updating migration checks and compatibility guidance without changing Canvas runtime or authentication policies.

Changes:

• Aligns dependency versions and checksums with the releases.
• Updates journal migration tests to expect schema 6 while preserving recorded evidence.
• Documents backup requirements, Substrate fresh-state reinstall, and checkpoint and network compatibility limits.

File	Description
internal/​sessionhost/​upgrade_test.go	Expects schema 6 after migration and preserves evidence checks.
go.sum	Updates checksums for the pinned releases.
go.mod	Pins Sessions, its adapter, and Substrate versions.
docs/​runtime-upgrade.md	Updates migration, reinstall, and compatibility guidance.
docs/​authenticated-sessions.md	Aligns dependency and upgrade notes with the new pins.

_{Review effort: Balanced}