feat(h5-session): Session Broker、run SSE replay 与 Finish 竞态修复

落地 H5 Session 架构 Patch 1–5（Broker 收口、Router decision、SSE taxonomy、goosed 边界检查），
并新增可选 MEMIND_RUN_STREAM_REPLAY run 事件回放与 H5 假交付 guard；修复 Finish 先于 agent-run
gate 导致 UI 永久 loading 的竞态，接入 verify:h5-session-patches 回归脚本。

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/check-goosed-proxy-boundary.mjs

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  checkGoosedProxyBoundary,
+  formatGoosedBoundaryViolations,
+  GOOSED_DIRECT_ALLOWLIST,
+  GOOSED_PROXY_ADAPTER_FILE,
+  GOOSED_PROXY_GUARDED_FILES,
+} from '../goosed-proxy-boundary.mjs';
+
+const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const violations = checkGoosedProxyBoundary(rootDir);
+
+if (violations.length > 0) {
+  console.error('goosed proxy boundary check failed:\n');
+  console.error(formatGoosedBoundaryViolations(violations));
+  console.error('\nH5 chat must reach goosed only via tkmind-proxy.mjs.');
+  console.error(`Allowlist: ${GOOSED_DIRECT_ALLOWLIST.join(', ')}`);
+  console.error(`Guarded: ${GOOSED_PROXY_GUARDED_FILES.join(', ')}`);
+  process.exit(1);
+}
+
+console.log(
+  `goosed proxy boundary ok (adapter=${GOOSED_PROXY_ADAPTER_FILE}, allowlist=${GOOSED_DIRECT_ALLOWLIST.length}, guarded=${GOOSED_PROXY_GUARDED_FILES.length})`,
+);