Add message store validation and session logging

[ssevera1]

What

Add validation checks and logging to detect message store corruption and track session state transitions.

Why

Prevents silent data corruption by validating message list integrity before appends and logs key lifecycle events for debugging session issues.

[claude]

Reviewed the full diff against the surrounding module and all call sites (voice/twilio_webhook.py, security.py). The change is purely additive logging plus a defensive type guard: no return values, control flow, or stored state change on any existing path, and the new RuntimeError is only reachable if a non-list messages is injected through ConversationStore.create(**kwargs). Message content is not logged (only counts), and the caller phone number in create() duplicates a line already emitted at voice/twilio_webhook.py:101, so there's no new PII exposure. Scope matches the title/description — one file, nothing unrelated.

Non-blocking follow-ups:

• store/conversations.py:7 — every other module uses an explicit "pdagent.*" logger name (security.py:15, voice/twilio_webhook.py:20); __name__ gives store.conversations, which a "pdagent"-scoped handler would silently drop.
• store/conversations.py:99 — the WARNING on removing a missing session can fire on a normal call, since /status (twilio_webhook.py:242) and the media-stream finally (twilio_webhook.py:193) race to remove the same call_sid. /status logs that same condition at debug as "already cleaned up", so this level is inconsistent.
• The isinstance(self.messages, list) guard is duplicated verbatim in both add_*_message methods; __post_init__ already validates the other fields and is the natural home.

Note: I was unable to run pytest in the review environment, so this is a read-only review; CI gates the merge.