feat(h5): web 联网能力、实时查询路由与 session Finish 对齐

- 新增 web 能力并挂载 platform/web（web_search/fetch_url）
- 实时查询强制 web skill，router fallback 与 await session Finish
- Session Broker 覆盖率/指标、stream replay 与相关单测/E2E 脚本

Co-authored-by: Cursor <cursoragent@cursor.com>

policies.test.mjs

@@ -32,11 +32,12 @@ test('readonly workspace strips write capabilities', () => {
 
 test('network deny strips egress capabilities', () => {
   const effective = applyPoliciesToCapabilities(
-    { shell: true, computer: true, charts: true },
+    { shell: true, computer: true, web: true, charts: true },
     { network_egress: 'deny' },
   );
   assert.equal(effective.shell, false);
   assert.equal(effective.computer, false);
+  assert.equal(effective.web, false);
   assert.equal(effective.charts, true);
 });