fix(desktop): bind submits to activated session

[CryptoDombili]

What does this PR do?

Prevents Desktop prompt submissions from being routed to a stale runtime session during asynchronous session switches.

The submit path now waits for the latest session.activate or session.resume acknowledgement and re-reads the active runtime session immediately before prompt.submit.

Related issue

Fixes #72971

Related to #66661, but this PR addresses the stale activation and submit-routing path rather than rejected-submit composer restoration.

Type of change

• Bug fix
• Tests
• New feature
• Security fix
• Documentation update
• Refactor

Changes made

• add a monotonic session activation barrier shared by session and prompt actions
• block prompt submission while the selected session activation is unacknowledged
• re-read the active runtime session immediately before prompt.submit
• fail closed when stored-session and runtime-session mappings disagree
• prevent stale activation responses from clearing a newer pending activation
• restore the composer text when submission is rejected by the session barrier
• add regression coverage for pending activation and runtime changes during asynchronous attachment upload

How to test

1. Start a response in one Desktop session.
2. Switch to or branch into another session while the response is still active.
3. Submit a message immediately in the newly selected session.
4. Verify that submission is blocked until the latest session activation is acknowledged.
5. Verify that the message is then submitted with the newly active runtime session ID.
6. Run the focused Desktop session-action and prompt-action tests.

Checklist

• The change is scoped to the Desktop session-switch and prompt-submit paths
• Regression tests were added
• Existing credential, backend, and persistence behavior is unchanged
• No unrelated files were modified

[teknium1]

Thanks for the focused investigation and regression coverage. This automated hermes-sweeper review found that current main already protects this routing path.

• apps/desktop/src/app/session/hooks/use-prompt-actions/submit.ts:244 detects a stale or incomplete durable-session/runtime binding rather than trusting the active runtime ref.
• apps/desktop/src/app/session/hooks/use-prompt-actions/submit.ts:430 resumes the durable routed session and verifies the active runtime, durable mapping, and selected session agree before submission.
• apps/desktop/src/app/session/hooks/use-prompt-actions/index.test.tsx:3195 covers replacement of a stale selected/runtime pair and asserts submission to the recovered runtime.
• This behavior was introduced by f0ff8d50970c35b67484056af9e913a6e6ba7e49 and is included in v2026.7.20; it is already an ancestor of this PR's base.