feat(h5-session): Session Broker、run SSE replay 与 Finish 竞态修复

落地 H5 Session 架构 Patch 1–5（Broker 收口、Router decision、SSE taxonomy、goosed 边界检查），
并新增可选 MEMIND_RUN_STREAM_REPLAY run 事件回放与 H5 假交付 guard；修复 Finish 先于 agent-run
gate 导致 UI 永久 loading 的竞态，接入 verify:h5-session-patches 回归脚本。

Co-authored-by: Cursor <cursoragent@cursor.com>

wechat-mp.mjs

@@ -5,6 +5,7 @@ import { fetch as undiciFetch } from 'undici';
 import { developerToolsFromPolicy } from './capabilities.mjs';
 import { mergeMessageContent } from './message-stream.mjs';
 import { reconcileAgentSession } from './session-reconcile.mjs';
+import { resolveSessionAccess } from './session-broker.mjs';
 import { isStubPublicHtmlContent, materializeMissingPublicHtmlWrites } from './mindspace-public-finish-sync.mjs';
 import { loadWechatMpConfig } from './wechat-mp-config.mjs';
 import { buildPublicUrl, PUBLISH_ROOT_DIR } from './user-publish.mjs';
@@ -1288,6 +1289,7 @@ export function buildWechatTextReply({
 export function createWechatMpService({
   config,
   userAuth,
+  sessionAccess = null,
   apiFetch,
   startAgentSession = null,
   sessionApiFetch = null,
@@ -1298,6 +1300,7 @@ export function createWechatMpService({
   linkExists = defaultPublicHtmlLinkExists,
   logger = console,
 }) {
+  const sessionStore = resolveSessionAccess({ userAuth, sessionAccess });
   if (!config?.enabled) {
     return {
       enabled: false,
@@ -1658,8 +1661,13 @@ export function createWechatMpService({
     // `/agent/start` already persists the owning user and goosed node via the
     // portal proxy. Re-registering here without the node can overwrite the
     // correct mapping back to node 0 in multi-goosed production.
-    if (!startAgentSession && typeof userAuth.registerAgentSession === 'function') {
-      await userAuth.registerAgentSession(userId, sessionId);
+    if (!startAgentSession) {
+      await sessionStore.registerSession({
+        userId,
+        sessionId,
+        target: 0,
+        origin: 'wechat',
+      });
     }
     await reconcileAgentSession(
       (pathname, init) => fetchForSession(sessionId, pathname, init),