fix(desktop): enforce project and session isolation

[diffen77]

Summary

• keep task-scoped project create/switch from mutating the profile-global Desktop project pointer
• make project-scoped new-session creation atomic with its immutable workspace target
• bind every Desktop prompt submission to the intended durable stored session and reject stale runtime mappings before queueing or persistence
• require backend contract v5 for upgraded Desktop clients while preserving non-Desktop callers

Incident

Prevents recurrence of #54527, including the confirmed cross-project contamination where Snabbgross prompts were persisted in a Mission Control conversation.

Verification

• scripts/run_tests.sh tests/tools/test_project_tools.py tests/test_tui_gateway_server.py -q — 405 passed
• Desktop Vitest — 81 passed
• npm run typecheck — passed
• ESLint — 0 errors (1 pre-existing hook warning)
• git diff --check — passed

[diffen77]

Final closeout candidate pushed: 09d26f8cb807ec7df09c76c8034e1bb0ccf18d1a, based on origin/main 15dc65eeda397a5d4d35edd6779141eeb8139944. This integrates the reviewed durable-session P1 closure across submit/interrupt/rewind/tile/delegate paths, including legacy omission compatibility and concurrent session-switch recovery. Independent exact-head review: PASS, no P0/P1. Gates at this head: scripts/run_tests.sh 413/413; focused Desktop 74/74 plus session-context-drift coverage; typecheck, targeted ESLint, production build, and git diff --check pass. Awaiting required upstream CI/maintainer approval; no direct-main mutation.

[teknium1]

Thanks for the focused project-routing and durable-session work. The current-main premise remains valid: tools/project_tools.py:105 and :126 still mutate the profile-global active pointer, while Desktop submit still routes only by runtime id (apps/desktop/src/app/session/hooks/use-prompt-actions/submit.ts:599-609).

Problems

• The contract must not remain v5. Current main already reserves v5 for large remote attachments (tui_gateway/server.py:4644-4648, apps/desktop/src/store/updates.ts:93-97, commit 254aeda122). A v5 remote would pass the client gate but lack this branch's durable-binding validation.
• The same runtime-only mutation remains on Desktop redirect: index.ts:708 sends only session_id, and tui_gateway/methods_session.py:2963-2972 validates only the runtime lookup. This PR does not change that path.
• Current main split RPC handlers out of server.py (tui_gateway/server.py:13293-13304), so the server-side portion needs to be transplanted into methods_prompt.py / methods_session.py.

Suggested changes

• Allocate the next contract version and cover v5 skew.
• Bind and validate session.redirect, or document and test a deliberate exclusion.
• Rework the handler changes against the current module split.

This is an automated hermes-sweeper review.

[teknium1]

Current main already uses contract v5 for the merged large-attachment WebSocket capability (254aeda122; current tui_gateway/server.py:4644-4648). Please allocate a new contract version for durable-session binding; otherwise a current v5 remote passes the Desktop gate but does not implement this validation.