feat(h5): web 联网能力、实时查询路由与 session Finish 对齐

- 新增 web 能力并挂载 platform/web（web_search/fetch_url）
- 实时查询强制 web skill，router fallback 与 await session Finish
- Session Broker 覆盖率/指标、stream replay 与相关单测/E2E 脚本

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/check-session-broker-coverage.mjs

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  checkSessionBrokerCoverage,
+  formatSessionBrokerCoverageViolations,
+  SESSION_BROKER_PATCH2_FILES,
+} from '../session-broker-coverage.mjs';
+
+const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const violations = checkSessionBrokerCoverage(rootDir);
+
+if (violations.length > 0) {
+  console.error('session broker coverage check failed:\n');
+  console.error(formatSessionBrokerCoverageViolations(violations));
+  console.error('\nSession ownership must go through session-broker.mjs (createSessionAccess / resolveSessionAccess).');
+  console.error(`Patch 2 modules: ${SESSION_BROKER_PATCH2_FILES.join(', ')}`);
+  process.exit(1);
+}
+
+console.log(
+  `session broker coverage ok (patch2=${SESSION_BROKER_PATCH2_FILES.length}, facade=session-broker.mjs)`,
+);