fix(gateway): skip fake finalize hook on first /new

[rylena]

Summary

• skip on_session_finalize when /new runs before any prior session exists
• keep on_session_reset firing for the newly created session
• add regression coverage for the first-session /new path

Verification

• scripts/run_tests.sh tests/gateway/test_session_boundary_hooks.py -q
• independent delegated code review: passed

Notes

• Existing authored PRs fix(commands): make /sessions CLI-only and functional #23680 and fix(cli): report passwordless sudo in status #18315 were inspected first; no new actionable review feedback was present, and their current failing checks reproduce on current upstream/main.
• Codex was attempted first, but it hit the known sandbox / CA-bundle workspace failures and Hermes handled the fallback implementation.

Closes #12176

[alt-glitch]

Duplicate of #23255 (and earlier #12184). All fix the same issue #12176 — skipping on_session_finalize when no prior session exists on /new.

[rylena]

Closing this as a duplicate of #23255 / #12184 for the same #12176 finalize-guard fix. I am not refreshing or pushing this branch further so effort stays concentrated on the earlier open PRs.