fix(panel): route answers to the card's session, not the queue head (#308)

[halindrome]

Fixes #308 — with several sessions waiting, answering the notch card could deliver the answer to a different session.

Cause

The card is addressed by session (.questionCard(sessionId:) / .approvalCard(sessionId:)), but every answer path resolved queue.removeFirst(), and the card rendered the head of the queue while taking its chrome (project name, cwd) from the surface's session. Any mutation of the head while a card is open re-targets the answer:

• handlePeerDisconnect → drainQuestions/drainPermissions(forSession:) removes the head when a session's socket drops (answered in the terminal, CLI exited), and showNextPending() only re-points the surface if Smart Suppress lets it auto-open — so a stale card can sit over a new head.
• showNextPending() reorders permissionQueue; the tool-use cache removes entries by index.
• A multi-question AskUserQuestion wizard collects answers over seconds of interaction.

Change

• approvePermission / denyPermission / dismissPermissionPrompt / answerQuestion / answerQuestionMulti / skipQuestion take an optional expectedSessionId and resolve that session's queued request.
• pendingPermission(forSession:) / pendingQuestion(forSession:) back the cards, so what is displayed and what is resolved cannot disagree.
• showNextPending() collapses a card surface whose session has nothing actionable left, so a drained or dismissed request can never leave an expanded, empty notch. "Actionable" uses the same dismissed-filtered predicate as nextVisiblePermissionIndex().
• Panel cards, session-list inline approvals, and keyboard shortcuts pass the acting session; the shortcut accessors are kind-matched so a permission hotkey fired over a question card addresses nothing.
• expectedSessionId: nil keeps head-of-queue behaviour for the surfaces that only ever mirror the head — iPhone/Watch Buddy control commands, answerCompanionQuestion, Codex app-server replies. The Buddy wire protocol carries no session id, so that path is unchanged by design and could be tightened separately.

Tests

Tests/CodeIslandTests/AppStateAnswerRoutingTests.swift (new, 15 cases) plus one addition to AppStateCodexRequestUserInputTests: cross-session answer/skip/approve/dismiss routing, the drained-head stale-card case for both queues, the Smart-Suppress path that produces a blank card, the dismissed-card case, session-scoped lookups, the kind-matched surface accessors, a Codex app-server request answered while queued behind another session, and the unchanged head behaviour when no session is passed.

swift test: 703 tests, 2 skipped, 0 failures.

Each behavioural guard was verified by mutating the production path it names and confirming the test fails without it — not just that it passes with it.

Review

This branch went through three review rounds before being opened here; the round notes are on the fork PR (halindrome#1) for anyone who wants the detail. Rounds 1 and 2 each found a real regression introduced by the previous round's fix — both are described in the commit messages, and both are fixed. Round 3 found no blocking defects.

Two things reviewers may want to weigh in on:

• Within-session keying. Requests are addressed by session, not by request id. Two requests from the same session could in principle render one and resolve the other; the mechanism is reachable by reading but I could not reproduce the timing window, so I left it rather than widening the change. Carrying a request id into the surface enum would close it.
• View-layer wiring is unpinned. Reverting the call-site changes in NotchPanelView / AppDelegate leaves the suite green — pinning that needs a SwiftUI view-test harness the project does not have.

Separately, #309 (dismissing an approval silences later requests from all sessions) was found while reviewing this and is untouched here.