test: cover serve session-lane order and non-string session ids

[cursor]

Risky behavior now covered

Per-connection frame lanes from #183 serialize work by params.session_id. The merge test showed that two sessions can run at once. These tests cover the ordering and parsing edges that were still open:

• A second prompt.submit on session A does not call the model until A's in-flight submit finishes, while session.clear on session B runs during that hang.
• After the first submit settles, session.clear on A sent during the still-held follow-up waits behind it. Dropping the lane when the first chain finishes would let that clear wipe the bag mid-run. A session-less health frame still returns while A is busy.
• Empty string, numeric 0, null, and array params share the session-less lane with session.create. A non-empty string session_id does not, so it is not blocked by that create.

Test files added/updated

• test/serve_prompts.test.ts
• test/serve_transport.test.ts

Why these tests materially reduce regression risk

Serve clients pipeline frames on one socket. If same-session ordering regresses, a clear or a second prompt can overlap an in-flight run and drop or fork that session's history. If non-string session ids grow their own lanes, session-less calls such as create, list, and health stop being ordered with each other. Both cases are concurrency bugs with a wide blast radius, and neither is implied by the existing cross-session test.

No production code changed. Focused vitest (test/serve_prompts.test.ts, test/serve_transport.test.ts, 40 tests) and tsc --noEmit passed. The full suite was not run; existing bun spawn and dist/ cases fail in this environment.