fix(core): guard Responses WebSocket session state

[cbusillo]

Summary

• refresh the websocket turn-state token when reconnect returns a new value
• avoid empty chained input deltas except for the post-warmup request
• wait for the websocket reader task to acquire the session lock before returning the response stream

Validation

• ./build-fast.sh