Opens a session from a Headers object alone — the headers-only read for non-HTTP entry points that have no request context to commit onto (a WebSocket onOpen handler, an auth strategy reading a cookie).

Read-only by contract: it runs the same envelope-open, snapshot-parse, and store-read path as SessionService.load but never advances the session's seen stamp, never commits, and never writes to the store. It returns null for every condition load treats as "no usable session" — the cookie is absent or empty, the envelope cannot be opened, the snapshot cannot be parsed, the absolute expiry or idle timeout has passed, or (on the store strategy) the stored entry is gone.