I'll mark this resolved, as I have made numerous changes.

Actually we put on a "cms__" prefix on cookies because of a lack of confidence they are going to integrate correctly for the typical user. The user needs to get the cookie domain and path consistent between Composr and the forum, which will be beyond the understanding of many users (not the making consistent necessarily, but choosing a universally-compatible domain and path combination). The user can remove the "cms__" in the installer if they wish.
To avoid confusion the cookie settings in the installer are no longer hidden for third party forum installation and it explicitly explains this.

The phpBB session cookie is created by the Composr phpBB forum driver, but the code was only executing if the "cms__" prefix is not there.