Normalize validated session metadata into the canonical SessionMetadata shape.

This is the single boundary where the provider wire format becomes the logical shape the rest of the app (and the price-signature check) reads: any small fields packed into b are merged back to the top level first, so every consumer sees one consistent shape regardless of how it was stored. Must only be called after hasRequiredSessionMetadata narrows the type — name is guaranteed non-empty by that guard. Fields omitted at creation (or absent from a malformed b) normalize to "".