[Bug]:MySQL AgentStateStore rejects Harness sandbox session IDs containing

```markdown
### Environment

- AgentScope Java: `2.0.1-sn-v2-SNAPSHOT`
- Java: 17
- Store: `MysqlAgentStateStore`
- Harness sandbox enabled

### Problem

When Harness persists sandbox state with session isolation, `SessionSandboxStateStore` generates a session ID like:

```text
sandbox/session/conv-a12d03e7-e213-4905-ad82-ad199ae1ea70
```

`MysqlAgentStateStore` then rejects it in `validateSessionId(...)`:

```text
java.lang.IllegalArgumentException:
AgentStateStore ID cannot contain path separators
```

Relevant call chain:

```text
SandboxManager.persistState(...)
-> SessionSandboxStateStore.save(...)
-> slotSessionId(...)
-> MysqlAgentStateStore.save(...)
-> validateSessionId(...)
```

### Expected behavior

Harness sandbox state should be persistable through `MysqlAgentStateStore`, or the sandbox store should encode/sanitize its internal scoped session IDs before delegating to `AgentStateStore`.

### Question

Should `SessionSandboxStateStore` use a storage-safe encoding for IDs such as `sandbox/session/`, or should `MysqlAgentStateStore` allow `/` in session IDs?

The database itself can store `/`; the failure comes from the application-level validation.