Piggyback Session message resolution on MCP calls

[yyjeqhc]

Summary

• add bounded session_message_resolution wrapper metadata to stateless MCP calls so a handled non-Todo Session message can be resolved on the same ordinary tool call
• preserve request-scoped ACK semantics: requires-ack guidance must include the same message id in ack_session_message_ids; ACK itself still never resolves or gates work
• keep resolution locked to the exact recording_session_id, strip wrapper metadata before concrete tool parsing/audit, and keep Todo completion on complete_session_message
• independently enforce the canonical resolve_session_message scope policy for piggyback closure, so the wrapper cannot inherit unrelated main-tool authority

Review finding fixed

Fresh review found that the original piggyback path authorized the recording Session but did not independently enforce the dedicated resolve tool scope. A caller with a permitted main-tool scope such as project:read could otherwise obtain Session closure authority without runtime:read.

The follow-up commit reuses check_runtime_tool_scope(..., "resolve_session_message") before ACK observation or mutation and adds a kernel regression proving scope denial leaves the message open.

Validation

• cargo fmt --all -- --check
• cargo check --all-targets — 0 warnings / 0 errors
• piggyback_resolution_cannot_inherit_main_tool_scope
• session_message_resolution_reuses_dedicated_resolve_scope
• http_mcp_2026_request_scoped_ack_redelivers_until_durable_resolution
• mcp_stateless_tools_list_uses_2026_result_shape
• stateless_message_resolution_wrapper_is_validated_and_removed_before_concrete_parsing
• wrapper_resolution_requires_ack_rejects_todo_and_replays_idempotently
• git diff --check origin/main..HEAD

No merge / deploy / restart / release.