fix(desktop): require session_id for all session-scoped gateway events

[Sahil-SS9]

Fixes #49106
Fixes #47709

Description

Previously only subagent.* events required an explicit session_id.
All other events (message.delta, message.complete, tool.start,
tool.complete, reasoning.delta, session.info, clarify.request,
approval.request, etc.) fell through to activeSessionIdRef.current
when unscoped, causing background session output to bleed into whichever
session the user was currently viewing.

This was the root cause of:

• Web/WeChat sessions leak history: turns from one Hermes session appear in another #49106: Web/WeChat session history leaking across active sessions
• [Bug]: Desktop shows newer session output in an older session #47709: Desktop stream-bleed family (newer session output in older one)

Fix

Expanded gatewayEventRequiresSessionId to require session_id for all
session-scoped events. Only truly global broadcasts (gateway.ready,
skin.changed) are exempt. Unknown event types are also required to
have a session_id (defensive).

The tui_gateway already stamps every session-scoped event with the
correct session_id, so this change is safe in normal operation.
If the gateway ever fails to stamp one (race, background-process
delivery, subagent mirror, stale transport), dropping is safer than
silently attributing to the focused session.

Verification

• Updated tests pass (gateway-events.test.ts)
• Quality gates: S1 (secrets), S2 (personal refs), B1 (branch current),
  C1 (conventional commits), C2 (no em-dashes), F1 (focused diff) all pass
• Only 2 files changed, no unrelated edits

[alt-glitch]

This was generated by AI during triage.

Duplicate of #49659 — verified by comparing diffs: both PRs make the identical change to apps/desktop/src/lib/gateway-events.ts, widening gatewayEventRequiresSessionId() to require session_id for every session-scoped event (exempting only gateway.ready / skin.changed) and dropping unscoped events rather than attributing them to the focused chat. #49659 is the earlier-open PR for #49106/#47709.

Related competing approaches that take a different mechanism (pin/resolve unscoped events to their originating session instead of dropping): #48281 and #47743. Maintainer should pick one mechanism across this cluster.

[Sahil-SS9]

Thanks @alt-glitch for flagging. You're right — #49659 made the same fix, and mine is a duplicate. I'll close this PR. Appreciate the pointer to #48281 and #47743 as well — I'll review those approaches.

[Sahil-SS9]

Closing as duplicate of #49659 — same fix authored independently. No further action needed on this branch.