feat(h5-session): Session Broker、run SSE replay 与 Finish 竞态修复

落地 H5 Session 架构 Patch 1–5（Broker 收口、Router decision、SSE taxonomy、goosed 边界检查），
并新增可选 MEMIND_RUN_STREAM_REPLAY run 事件回放与 H5 假交付 guard；修复 Finish 先于 agent-run
gate 导致 UI 永久 loading 的竞态，接入 verify:h5-session-patches 回归脚本。

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/verify-h5-session-patches.mjs

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import { spawnSync } from 'node:child_process';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const testFiles = [
+  'session-broker.test.mjs',
+  'agent-run-stream.test.mjs',
+  'agent-run-routes.test.mjs',
+  'agent-run-gateway.test.mjs',
+  'sse-event-taxonomy.test.mjs',
+  'goosed-proxy-boundary.test.mjs',
+  'chat-agent-run-gate.test.mjs',
+  'chat-finish-sync.test.mjs',
+  'conversation-display.test.mjs',
+  'mindspace-h5-html-finish-guard.test.mjs',
+];
+
+function run(label, command, args) {
+  const result = spawnSync(command, args, {
+    cwd: root,
+    stdio: 'inherit',
+    env: process.env,
+  });
+  if (result.status !== 0) {
+    console.error(`[verify:h5-session-patches] failed at ${label}`);
+    process.exit(result.status ?? 1);
+  }
+}
+
+run('unit tests', process.execPath, ['--test', ...testFiles]);
+run('goosed proxy boundary', process.execPath, ['scripts/check-goosed-proxy-boundary.mjs']);
+run('mindspace publish guards', process.execPath, ['scripts/verify-mindspace-publish-guards.mjs']);
+
+console.log('h5 session patch verification ok');