Submit Session Confirmation

HTTP twin of the confirmation socket handlers, for detached runs.

A detached client observes status == "pending_confirmation" on its poll, reads the confirmation id and options from the durable actions log, and answers here. Command approvals resolve an in-memory future on this replica and fan out to peers via the socket-event bus, with a persisted fallback by call_id.