Safe to start a php session on get_header action?

There’s nothing that requires that get_header run before output starts, you could put it in the middle of a template file after other content and still have a perfectly valid theme.

template_redirect is the last action where it is guaranteed that no output has started yet.