bug(remote): remote clients can act on terminal sessions the phone is never shown #866

Expected behavior

The remote companion lists, streams and accepts actions for agent sessions only. Terminal sessions are deliberately outside its scope: SessionFeedSource documents that listing them would create "an invisible command-execution surface on the phone", and #430 / #497 record the same boundary.

Actual behavior

The terminal filter is applied only to the started event (and the initial seed). Every other forwarded session event is relayed for any session id, including terminals, and some are cached for late-joining clients. On the inbound side, the submit and interrupt handlers in RemoteServer.apply accept any session id without checking what kind of session it is.

So a paired client can observe terminal session ids through frames it should never receive, and can then write Enter or Esc into a plain shell.

Impact

Low likelihood: it requires an already paired and authenticated device. But it contradicts the documented remote scope, and it undermines the text-delivery contract for terminals (templates and vault keys are pasted without Enter so the user reviews the line before it runs).

Fix direction

• SessionFeedSource: drop every outbound frame whose session is a terminal, at the single emit choke point, not per channel.
• RemoteServer: refuse submit, interrupt and condition-action writes for sessions that are not agent sessions.
• Regression tests for both directions.

Environment

main at ad9ddc4. Found while researching terminal feature parity.