fix(session): make InMemorySessionStore.messageID atomic (#3592)

[aheritier]

Summary

Fixes #3592 — InMemorySessionStore.messageID was a plain int64 incremented
without synchronization while the store is accessed concurrently (HTTP handlers

• the runtime PersistenceObserver). Lost increments could produce duplicate
  message IDs, which in turn let UpdateMessage (which searches by ID) edit the
  wrong message.

This is finding A3 from the internal codebase audit.

What changed

• messageID is now atomic.Int64, incremented via Add(1). ID semantics are
  preserved: the counter starts at zero and Add(1) yields 1, 2, …, matching
  the previous pre-increment behavior.

Testing

• pkg/session/store_messageid_race_test.go — 200 concurrent AddMessage
  calls assert all returned IDs are unique. Verified to fail (duplicate IDs +
  data-race warnings, all iterations) against the pre-fix plain-int64 code and
  pass now.
• task dev + go test -race -count=2 ./pkg/session/...: green (validated in
  isolation).

Opened as a draft pending final maintainer review.