feat(gateway): migrate SessionsController.Seal off SessionId.IsSubAgent substring (Phase 5 / F-6 step 2b)

[sytone]

Summary

Migrates the last runtime call site for SessionId.IsSubAgent substring matching off the legacy stringy check and onto the typed Session.SessionType discriminator. Closes #555 and completes Phase 5 / F-6 structurally — all production runtime classification now flows through the typed signal.

Fold-in commit also closes a per-session authorization gap on the Seal endpoint surfaced by the critique sweep.

Changes

File	Δ	Purpose
src/gateway/BotNexus.Gateway.Api/Controllers/SessionsController.cs	+17	(a) Replace !sid.IsSubAgent guard with !session.SessionType.Equals(SessionType.AgentSubAgent). (b) Add AuthorizeSessionCaller(session) check (mirrors GetMetadata / PatchMetadata). (c) Add using SessionType = BotNexus.Domain.Primitives.SessionType; alias.
tests/architecture/BotNexus.Architecture.Tests/AgentKindArchitectureTests.cs	-5 / +14	Remove the SessionsController.cs allowlist entry (4 → 3 entries). Rewrite <remarks> declaring Phase 5 / F-6 structurally complete, citing #557 + #555 history.
tests/gateway/BotNexus.Gateway.Tests/SessionsControllerTests.cs	+144	Six new tests: 3 typed-signal pins + 3 authorization pins.

Total: 3 files, ~165 LoC.

Motivation

SessionsController.Seal was the only remaining production runtime call site that classified sub-agent sessions by substring matching on the SessionId rather than reading the typed SessionType discriminator persisted on the session row. This caused two observable bugs:

1. A session created with SessionType=AgentSubAgent but a plain SessionId (no ::subagent:: infix) was incorrectly rejected for sealing.
2. A session created with SessionType=UserAgent but a SessionId that happened to contain ::subagent:: was incorrectly accepted for sealing.

Both shapes are reachable through legitimate flows: sub-agents spawned with custom id shapes hit case (1); user-typed session ids containing the substring hit case (2). PR #557 migrated GatewayHost.ResolveSessionType off the same substring; this PR finishes the job at the controller layer.

After this PR, the only SessionId.IsSubAgent references left in production code are 3 allowlisted entries — all justified, with no runtime classification dependence:

• SessionId.cs — declaration site.
• SessionStoreBase.cs — read-only InferSessionType back-fill for legacy rows persisted before SessionType was reliably saved.
• InProcessIsolationStrategy.cs — defense-in-depth OR-gate (typed signal is the primary).

The architecture fence (AgentKindArchitectureTests) will now fail CI if any new code introduces a substring check outside the allowlist.

Multi-model critique sweep

All 3 critique agents launched in parallel before opening the PR. Findings table:

Agent	Model	Verdict	Action
seal-plan-vs-impl	code-review / claude-opus-4.7	PASS — all 4 DoD line-items satisfied, scope-reduction explained, tests catch all 3 regression shapes (revert-to-substring, OR-combined, AND-combined).	None.
seal-security	security-review / gpt-5.5	PASS — no exploitable privilege-escalation, tampering, or fail-open path found; auth middleware still applies; SessionType.Equals is null-safe.	None.
seal-bug-hunt	rubber-duck / gpt-5.3-codex	1 HIGH + 1 LOW	HIGH folded in (commit e105332f); LOW deferred (existing store integration tests already cover SessionType round-trip).

HIGH (folded in)

Seal endpoint lacked per-session authorization check. GetMetadata and PatchMetadata enforce AuthorizeSessionCaller, but Seal did not — meaning any authenticated caller able to discover a sub-agent sessionId could seal someone else's session (control-plane integrity / DoS risk). Fold-in commit e105332f adds the check using the established pattern, with 3 new pinning tests (mismatched → 403, matching → seal, missing identity → bypass).

The same gap exists on Delete, Suspend, Resume — left out of this PR to preserve scope, filed as #558 for a focused follow-up.

LOW (deferred)

In-memory test seeding aliases the same object reference. The new typed-signal pins seed SessionType via InMemorySessionStore (which stores object references rather than serializing), so persistence-layer regressions wouldn't surface in these specific tests. Deferred because SessionType round-trip is already covered for the FileSessionStore and SqliteSessionStore paths in SessionStoreExistenceQueryTests.cs:189 and SessionModelWave2Tests.cs:113. This PR adds controller-level pins; persistence-level pins live in their own suite.

Validation

dotnet build BotNexus.slnx --nologo --tl:off     # 0 warnings / 0 errors (TreatWarningsAsErrors=true)
dotnet test  BotNexus.slnx --no-build            # 0 failed
  - SessionsControllerTests:        57 / 57 passed (was 54 — +3 typed + +3 authz)
  - AgentKindArchitectureTests:     49 / 49 passed
  - Gateway.Tests project total:    1821 / 1822 passed (1 expected skip)

Phase 5 / F-6 status

This PR closes the last runtime call site. F-6 is structurally complete.

Closes #555
Refs #523, #557, #558