[CLI] bw status returns "locked" with valid session token from bw unlock --raw (2026.4.1, macOS)

## Reproduction

On `bw --version` 2026.4.1 (Homebrew `bitwarden-cli` formula, macOS 25.4.0):

```bash
bw lock
S=$(bw unlock --raw)
echo "exit: $? token length: ${#S}"
# → exit: 0 token length: 88 (looks valid)

bw status --session "$S" | jq '{status, lastSync}'
# → {"status": "locked", "lastSync": ""}
```

`bw status` reports `locked` despite being passed the session token that `bw unlock --raw` just returned and despite `lastSync` reflecting a successful recent sync.

## Expected behavior

`bw status --session "$VALID_SESSION"` should return `unlocked`, as should `bw status` when `BW_SESSION` is set in the env to a valid session token.

## What still works

- `bw unlock --raw` issues a valid 88-char session token (exit 0).
- `bw sync` succeeds (lastSync updates).
- `bw get password X` returns the value (re-prompts for master password each invocation despite BW_SESSION being set).
- `bw list items` returns items (same re-prompt behavior).

So the session token from `bw unlock --raw` appears to be effectively non-functional; every subsequent command falls back to interactive master-password prompts.

## Impact

Shell scripts that gate on `bw status` (e.g., wrapper functions that verify the vault is accessible before proceeding) are blocked by the false-`locked` status. Workaround: test access functionally via `bw list items >/dev/null` instead.

## Environment

- OS: macOS 25.4.0 (Darwin)
- bw: 2026.4.1 (Homebrew `bitwarden-cli`)
- Node: shipped with bw install (v25.9.0 per error trace observed during pipe-write failure on a separate command)
- Self-hosted server: no (default vault.bitwarden.com)
- Server-side account state: standard, single-org membership confirmed

Start by reproducing the reported sequence with `bw unlock --raw`, `bw status --session`, and `BW_SESSION`, then trace the CLI's status and session-token handling. Compare the status result with the commands that still succeed; done means valid tokens consistently produce `unlocked` without interactive prompts.

Written by the indexing model from the issue text.