fix(web): bind first prompt to created session

[testikun]

Problem

Closes #466. A newly created Web Session returned a creation receipt, but the browser discarded its stable identity and later read the first prompt target from a refreshed snapshot. Another tab could activate a different Session between those steps, causing the original prompt or preselected model to be retargeted. The path-based confirmation added by #482 also could not represent a Pi Session before its first persisted file exists.

Value

The first prompt and its draft model stay bound to the Session the user created. Cross-tab activation now stops the send and preserves the Composer input instead of silently adopting another workspace or Session.

Approach

• Return the activated sessionId from the Pi runtime and Host creation receipt/events; keep sessionPath optional before first persistence.
• Bind creation to { commandId, sessionId, optional sessionPath, workspacePath, epoch } while preserving the existing workspaceDraft authority from fix(web): bind workspace drafts to confirmed Pi sessions #482.
• Confirm that exact target after canonical snapshot refresh, after draft model selection, and immediately before prompt admission.
• Fail closed on malformed receipts or external activation without changing the existing Host/runtime SESSION_CONFLICT and prompt idempotency boundaries.
• Add store, Host/runtime, and real-browser regression coverage plus docs/design/WEB_SESSION_CREATION_TARGET.md.

Validation

• bun run check passed: config contract, discipline ledger, Web build/typecheck, format, lint, and TypeScript typecheck.
• bun run test passed: 1,465 Node tests passed, 1 platform-specific test skipped, 0 failed; Web suite 134/134.
• bun run test:web:e2e passed: 12/12. The new test starts the current checkout's standalone Host/Pi runtime, delays Session A's HTTP receipt, switches to Session B through an independent request while suppressing SSE, and verifies that no prompt is sent and A's input remains in the Composer.
• Focused suites passed: Web store 60/60, Pi runtime 30/30, Web Host 27/27.
• Ablation: separate event-observed Session/path state was removed; the merged store suite remained 60/60 because commandId correlates events and the receipt sessionId is the target authority. Removing receipt-bound sessionId validation restores the reported retargeting failure.
• The local shell had no separately installed pi executable, so installed-package pi list provenance was unavailable. Playwright invoked bin/openpi.js directly from this checkout. No model call was made.

Impact

• User-visible behavior: a cross-tab Session switch blocks the first send with an explicit notice and preserves the draft.
• Model-visible context/tools: none.
• Runtime/lifecycle: Session creation receipts and correlated events now include the stable activated Session id.
• Persisted config/data: none; Session paths remain Pi-owned and optional before first persistence.
• Compatibility/risk: existing workspace-draft, active-Session, model-selection, retry, and Host admission guards remain in place; the protocol addition is additive for the Host response and required by the updated Web client.