Coordinator-owned read model for active session state.

SessionRegistry remains the storage mechanism, but callers outside the coordinator must treat it as an internal read model exposed through this API.