CAUTION comment on noiseSessionStub — flag latent break if performResponderAuth ever uses session arg (Phase 2 ambiguity #2 followup)

@@ -1409,6 +1409,13 @@14091409         // frames here ride the Noise transport (native encrypts/decrypts).14101410         const identity = await vault.getSyncIdentity();14111411         try {1412+          // CAUTION: noiseSessionStub is a structural placeholder — the real1413+          // Noise NK handshake runs natively, so JS never holds the session1414+          // object. performResponderAuth currently `void`s this argument,1415+          // which is why identity-passthrough encrypt/decrypt and a zero1416+          // handshake hash are safe. If performResponderAuth is ever updated1417+          // to actually use this argument, this auth path will silently break1418+          // (no type error). Revisit this stub if that helper changes.14121419           const noiseSessionStub = {14131420             encrypt: (b: Uint8Array) => b,14141421             decrypt: (b: Uint8Array) => b,