feat(tess): wire durable interaction surfaces

apps/gateway/src/agent/tess-durable-session.service.ts

@@ -1,5 +1,5 @@
 import { ForbiddenException, Inject, Injectable } from '@nestjs/common';
-import { DurableSessionCoordinator } from '@mosaicstack/agent';
+import { DurableSessionCoordinator, type DurableSessionIdentity } from '@mosaicstack/agent';
 import type { TessProviderOutboxDto } from './tess-durable-session.dto.js';
 import { TessDurableSessionRepository } from './tess-durable-session.repository.js';
 import {
@@ -23,6 +23,20 @@ export class TessDurableSessionService {
     this.coordinator = new DurableSessionCoordinator(repository);
   }
 
+  /** Enroll a verified runtime session under the stable cross-surface conversation handle. */
+  async enroll(
+    identity: DurableSessionIdentity,
+    context: RuntimeProviderRequestContext,
+  ): Promise<void> {
+    if (
+      identity.ownerId !== context.actorScope.userId ||
+      identity.tenantId !== context.actorScope.tenantId
+    ) {
+      throw new ForbiddenException('Durable Tess enrollment scope mismatch');
+    }
+    await this.coordinator.create(identity);
+  }
+
   async queueProviderSend(input: TessProviderOutboxDto): Promise<void> {
     const snapshot = await this.coordinator.snapshot(input.sessionId);
     this.assertScope(snapshot.identity.ownerId, snapshot.identity.tenantId, input);