refactor(gateway): extract GatewaySessionMixin from run.py (slice 21 of #54962)

[andrexibiza]

Related #54962 #55138

What / Why

God-file decomposition campaign for gateway/run.py (26.8k-line monolith). This PR extracts the session-lifecycle cluster out of the GatewayRunner class into a new gateway/session_mixin.py module (GatewaySessionMixin), following the codebase's established mixin pattern (gateway/authz_mixin.py, gateway/kanban_watchers.py, gateway/slash_commands.py).

34 methods / ~1,168 lines moved verbatim (byte-identical bodies — docstrings, comments, decorators, and the exclusive _BUSY_QUEUE_MAX_PENDING class attribute + _CONVERSATION_SCOPED_STATE registry move with their methods). Zero behavior change:

• GatewaySessionMixin is added first in GatewayRunner's bases; all self.* cross-references resolve unchanged via the MRO (including calls from staying methods like _dequeue_pending_event → self._promote_queued_event).
• Module-level logger = logging.getLogger("gateway.run") keeps log records byte-identical (same convention as slash_commands.py).
• Shared run.py helpers/constants that must stay in run.py (_AGENT_PENDING_SENTINEL, _float_env, _STALL_NOTIFY_SEND_TIMEOUT_SECONDS) are imported lazily inside the using method (from gateway.run import ... at call time) — this module never imports gateway.run at module level, so no import cycle. _STALL_NOTIFY_SEND_TIMEOUT_SECONDS deliberately stays in run.py because test_session_stall_watchdog.py monkeypatches it on the gateway.run module.
• _CONVERSATION_SCOPED_STATE moves to the mixin module and is re-imported into gateway.run (with # noqa: F401) so the public test contract (from gateway.run import _CONVERSATION_SCOPED_STATE) stays green.

Clusters included: /queue FIFO helpers, /goal continuation machinery, session run-generation guards, turn-lease release/rebind, the conversation-scope funnel (_clear_conversation_scope + _clear_session_boundary_security_state), session expiry + stall watchers, session env propagation, pinned session-context prompt.

How to test

# Import + MRO smoke test (venv of main checkout, worktree as cwd)
python -c "import gateway.run; assert hasattr(gateway.run.GatewayRunner, '_enqueue_fifo')"

# Targeted suites (all green)
python -m pytest tests/gateway/test_queue_consumption.py tests/gateway/test_steer_fifo_overwrite.py \
  tests/gateway/test_goal_status_notice.py tests/gateway/test_goal_continuation_drain.py \
  tests/gateway/test_goal_verdict_send.py tests/gateway/test_conversation_scope_funnel.py \
  tests/gateway/test_session_stall_watchdog.py tests/gateway/test_watchdog_review_76354.py \
  tests/gateway/test_session_boundary_hooks.py tests/gateway/test_prompt_tail_freeze.py \
  tests/gateway/test_turn_lease.py tests/gateway/test_stop_thread_sibling.py \
  tests/gateway/test_session_env.py tests/gateway/test_session_boundary_security_state.py \
  tests/gateway/test_restart_resume_pending.py tests/gateway/test_session_state_cleanup.py \
  tests/gateway/test_session_split_brain_11016.py tests/gateway/test_42039_duplicate_user_message.py \
  tests/gateway/test_run_progress_topics.py tests/gateway/test_gateway_silence_tokens.py \
  tests/gateway/test_first_turn_session_meta_rebaseline.py tests/gateway/test_session_race_guard.py \
  tests/gateway/test_busy_session_ack.py tests/gateway/test_matrix_project_context_isolation.py \
  tests/gateway/test_compression_failure_session_sync.py tests/gateway/test_shutdown_cache_cleanup.py \
  tests/gateway/test_tool_response_drop_recovery.py tests/gateway/test_10710_auto_reset_evicts_cached_agent.py \
  tests/gateway/test_telegram_topic_mode.py tests/gateway/test_gateway_command_dispatch_minimal.py \
  tests/gateway/test_startup_restart_race.py tests/gateway/test_session_hygiene.py \
  tests/gateway/test_priority_path_compression_demotion_56391.py tests/gateway/test_incomplete_gateway_turns.py \
  -q --no-header -p no:cacheprovider

Result: 219 passed, 0 failed (34 files).

Additional checks: git diff --check clean; scripts/check-windows-footguns.py gateway/run.py gateway/session_mixin.py clean; moved bodies verified byte-identical against the base commit (34/34).

Platforms tested

• Windows 10 (git-bash), Python 3.11 — import smoke test + 219 targeted pytest cases.
• No platform-specific behavior touched (pure mechanical move).

Shrink

• gateway/run.py: 26,823 → 25,549 lines (−1,274)
• gateway/session_mixin.py: new, 1,310 lines (34 methods + _BUSY_QUEUE_MAX_PENDING + _CONVERSATION_SCOPED_STATE)

Scope note

Pure mechanical extraction — no behavior change, no logic edits, no reformatting of moved code (only five from gateway.run import ... lines added inside method bodies for shared helpers that must remain in run.py). _AGENT_PENDING_SENTINEL, _float_env, and _STALL_NOTIFY_SEND_TIMEOUT_SECONDS intentionally stay in gateway/run.py (shared with other mixins/in-flight slices or monkeypatched by tests); the moved methods access them via deferred import.

Part of #54962
Part of #55138

Part of #78647
Part of #78791