fix: resolve affinity from authoritative invocation session

[rjcloudsigma]

Summary

• resolve TaaS affinity identity per stream invocation from OpenClaw options.sessionId
• cover managed GPT-5.6, Kimi, and simple-completion transports
• keep payload and response correlation invocation-local under concurrency
• never derive conversation identity from agent or workspace scope when no authoritative session exists
• bump plugin to v0.10.0

Why

Provider wrappers are constructed before an embedded run is bound, so wrapper context can lack the session ID even though the stream invocation carries it. Resolving identity at wrapper construction left a large GPT request population without caller session metadata.

Agent/workspace fallback was also unsafe because those scopes outlive individual conversations and could merge unrelated sessions or workers onto one sticky key.

Verification

• npm test: 20/20 plugin tests passed
• smoke and TypeScript checks passed
• focused OpenClaw transport tests previously passed: 165/165 agent wrapper tests and 17/17 simple-completion tests
• concurrent interleaving regression proves no session cross-contamination
• git diff --check passed