修复 Web 工作区会话串线问题

[Yumiue]

背景

Web 端同一个 WebSocket 连接在切换、重连或取消运行时，存在依赖连接级兜底会话的路径。当前端尚未恢复工作区上下文，或后端按连接兜底解析会话时，可能把一个工作区的会话绑定/取消/事件流误用到另一个工作区。

修改内容

• Gateway 的 stream fallback 改为按 workspace_hash 约束，避免同连接跨工作区复用旧 session。
• gateway.bindStream 在绑定前校验 session 是否属于当前工作区 runtime，不可见则拒绝绑定。
• Web RuntimeProvider 在初始连接和重连时先同步当前工作区，再恢复 session 列表与 stream bind。
• Web cancel 请求显式携带 session_id，避免后端仅靠连接级兜底推断。
• 请求日志增加 workspace_hash，便于后续排查跨工作区链路问题。
• 补充 gateway 与 Web 生命周期/取消回归测试。

验证

• go test ./internal/gateway
• npm test -- --run src/components/chat/ChatInput.test.tsx src/context/RuntimeProvider.lifecycle.test.tsx
• npm run build

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[codecov]

Codecov Report

❌ Patch coverage is 96.07843% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/gateway/bootstrap.go	92.30%	1 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[fennoai]

I found two regressions in the new workspace/session isolation flow. Both are user-visible and are caused by stricter session scoping surfacing stale frontend state.