feat(h5-session): Session Broker、run SSE replay 与 Finish 竞态修复

落地 H5 Session 架构 Patch 1–5（Broker 收口、Router decision、SSE taxonomy、goosed 边界检查），
并新增可选 MEMIND_RUN_STREAM_REPLAY run 事件回放与 H5 假交付 guard；修复 Finish 先于 agent-run
gate 导致 UI 永久 loading 的竞态，接入 verify:h5-session-patches 回归脚本。

Co-authored-by: Cursor <cursoragent@cursor.com>

direct-chat-service.test.mjs

@@ -21,6 +21,51 @@ test('direct chat is enabled by default', () => {
   }), true);
 });
 
+test('direct chat registers session through sessionAccess when provided', async () => {
+  const registered = [];
+  const service = createDirectChatService({
+    enabled: true,
+    userAuth: {},
+    sessionAccess: {
+      enabled: true,
+      async registerAgentSession(userId, sessionId, target) {
+        registered.push({ userId, sessionId, target });
+      },
+    },
+    llmProviderService: {
+      async createChatCompletion() {
+        return {
+          ok: true,
+          providerId: 'custom_deepseek',
+          model: 'deepseek-chat',
+          reply: 'ok',
+          usage: { inputTokens: 1, outputTokens: 1 },
+        };
+      },
+    },
+    sessionSnapshotService: {
+      async get() {
+        return null;
+      },
+      async save() {},
+    },
+  });
+
+  const result = await service.run({
+    userId: 'user-1',
+    requestId: 'req-access',
+    userMessage: {
+      role: 'user',
+      content: [{ type: 'text', text: 'hi' }],
+      metadata: { userVisible: true },
+    },
+  });
+
+  assert.equal(registered.length, 1);
+  assert.equal(registered[0].target, 'h5-direct');
+  assert.equal(isDirectChatSessionId(result.sessionId), true);
+});
+
 test('direct chat creates a direct session, saves snapshot, and bills returned usage', async () => {
   const registered = [];
   const saved = [];