This PR resolves the semantic clustering findings across internal/ by relocating outlier functions/types to their owning domains and removing duplicate validation logic between config and guard. It also resolves an ambiguous transport-vs-server session method name collision.

• Config expansion logic consolidation

  • Moved expandMapInPlace and expandTracingVariables into internal/config/expand.go so ${VAR} expansion behavior lives in one place.
  • Removed duplicated definitions from config_stdin.go and config_tracing.go.

• Guard/config validator consolidation

  • Added canonical reusable validators in internal/config/guard_policy_validation.go:
    • ValidateStringArrayField
    • IsValidAllowOnlyReposValue
  • Updated internal/guard/wasm_validate.go to delegate to config validators instead of reimplementing equivalent checks.

• WASM guard discovery ownership moved to guard

  • Moved filesystem discovery helpers into internal/guard/wasm.go:
    • GetWASMGuardsRootDir
    • FindServerWASMGuardFile
  • Updated internal/server/guard_init.go and related tests to call guard-owned helpers.

• DIFC filtered-item map helper outliers removed

  • Inlined author/number extraction directly in buildFilteredItemLogEntry (internal/server/difc_log.go) per issue recommendation.
  • Removed standalone helper test file and added focused edge-case coverage in difc_log_test.go.

• Logger cleanup API scope

  • Unexported ExtractErrorMessage to extractErrorMessage (internal/logger/log_cleanup.go) since usage is internal/test-only.

• MCP tag snapshot type placement

  • Moved AgentTagsSnapshot and GetAgentTagsSnapshotFromContext from connection.go to connection_logging.go to colocate declarations with actual logging consumers.

• Label-agent helper placement

  • Moved emptyAgentLabelsResult and ApplyLabelAgentResult from internal/guard/guard.go to internal/guard/label_agent.go alongside RunLabelAgent.

• Session ID truncation ownership

  • Moved session-specific truncation behavior from internal/strutil into internal/server/session_util.go as truncateSessionID.
  • Updated server call sites; removed TruncateSessionID from strutil and moved tests to server package.

• Naming collision removal

  • Renamed (*mcp.Connection).requireSession() to requireSDKSession() to distinguish SDK transport session validation from server.requireSession(ctx) lifecycle behavior.

// before
if err := c.requireSession(); err != nil { ... }

// after
if err := c.requireSDKSession(); err != nil { ... }