feat(session,runtime): 多角色并存—按会话选角（迁移0011 + 按回合解析 + agent池 + 提取器修正）

按 DevDocs/design/22 批次 1 后端（§2/§3/§4.1-4.5/§4.7/§5 验收 1-6）。
- 迁移 0011：chat_sessions.persona_id + chat_messages.persona_id（均 DEFAULT ''，无回填 → 升级零风险）；同步包内幂等 DDL；**真实库升级验证**（拷贝 data/cyrene.db 到临时目录跑 MigrateUp：既有 1 会话/109 消息 persona 仍为 ''，原库未被触碰）
- history：SessionMeta/Message 加 PersonaID + SetSessionPersona；ListSessions/List/scan/Append 带上
- runtime：SessionEnv.PersonaID + loop.personaFor(ctx) 替换固定 l.personaID（memory/request/turn）+ **agent 池**（Options.Agents，按角色取 instructions，未命中回落）+ **提取器不再把 persona 烤死在构造期**（多角色下记忆不再永远记在 cyrene 名下）+ **thinking 旋钮改为按会话角色解析**（否则角色 Y 会用角色 X 的预算/展示）
- gateway：会话 DTO/POST/PATCH 支持 personaId；ws/rest/voice 的 OwnerEnv 硬编改为**按会话解析角色**（actor 元数据语义不变）；admin memories 搜索去掉硬编 cyrene
- Docs/api-client v0.42；**两处有意的行为收紧**已写明：POST /sessions body 非法 JSON → 400（原先完全忽略 body；空/null/{} 仍 201）；POST /admin/memories/search 省略 personaId 且无默认角色 → 400（原先默认查 cyrene）
- 测试：design/22 §5 验收 1-6（记忆隔离/提示词首条 system/情绪按角色/提取 persona 归属/迁移兼容）+ 进程内 e2e（断言 adapter 收到的 model.Request.Messages[0] 即该角色的 systemPrompt）
- **已知未做（留批次 2 / 待确认）**：① IM 与渠道级未做 → **§7-3「owner 私聊镜像随主会话角色」尚未生效**；② 请求级覆盖未实现（本批只做会话级）；③ **§7-5 的「上下文发送角色标记」只完成存储+DTO 半边**——消息 persona 已落库且 DTO 已带，但模型上下文不从 chat_messages 重建，「第 N 条是谁说的」尚未进上下文（需确认是否属批次 2）；④「切角色重建摘要」当前是空操作（压缩未接线）；⑤ thinking 旋钮仅在流式路径生效（非流式 agent.RunStep 不带，A 批次既有性质）
- 验收：go build/vet/test 全绿 + linux/amd64 与 darwin/arm64 交叉编译（既有 flake 本轮未触发；同批 session_orchestrator.go 一度 501 行 → 抽出 session_tail.go）

internal/services/gateway/history.go

@@ -1,7 +1,9 @@
 package gateway
 
 import (
+	"encoding/json"
 	"errors"
+	"io"
 	"net/http"
 	"strconv"
 	"strings"
@@ -32,6 +34,12 @@ type historySessionSummary struct {
 	// cursor is session-scoped and single-owner: reading on any one end clears the
 	// badge for every end of the account.
 	UnreadCount int `json:"unreadCount"`
+	// PersonaID is the role this session belongs to (design/22 §2/§4.5). It is the
+	// single source of truth for which role answers in the conversation, and the
+	// client uses it to render the role's name/avatar for the active session.
+	// Omitted when empty, and empty means "inherit the global default role", so an
+	// old client that ignores the field keeps showing the default role's visuals.
+	PersonaID string `json:"personaId,omitempty"`
 }
 
 // historyLastMessage is the wire shape of the last-message preview in a session summary.
@@ -64,7 +72,13 @@ type historyMessage struct {
 	// source that produced the message (e.g. "kook:3bef..."). It is blank for
 	// Web-originated messages.
 	AdapterID string `json:"adapterId,omitempty"`
-	CreatedAt  int64  `json:"createdAt"`
+	// PersonaID is the role that SPOKE this message (design/22 §7-5). A session may
+	// switch roles while keeping its context, so the authoring role is stored and
+	// returned per message and the client renders the bubble with that role's
+	// name/avatar. Omitted when empty, and empty means "the global default role" —
+	// the pre-multi-character rows read exactly as before.
+	PersonaID string `json:"personaId,omitempty"`
+	CreatedAt int64  `json:"createdAt"`
 }
 
 // handleHistorySessions returns the main session first, then every sub session (oldest
@@ -84,6 +98,7 @@ func (s *Server) handleHistorySessions(w http.ResponseWriter, r *http.Request) {
 			Title:       m.Title,
 			CreatedAt:   m.CreatedAt,
 			Pinned:      m.Pinned,
+			PersonaID:   m.PersonaID,
 			LastMessage: toHistoryLastMessage(m.LastMessage),
 			UnreadCount: m.UnreadCount,
 		})
@@ -100,8 +115,21 @@ func toHistoryLastMessage(m *history.MessageSummary) *historyLastMessage {
 	return &historyLastMessage{Role: m.Role, Content: m.Content, CreatedAt: m.CreatedAt}
 }
 
+// createSubSessionRequest is the POST /api/v1/sessions body. The body itself is
+// optional (a client that just wants a plain session sends none), and personaId is
+// the optional role the new session is bound to (design/22 §4.5). It is the
+// "seed the new session's role" half of the design's precedence: an explicit role
+// here becomes the session-level binding (the single source of truth), while
+// omitting it leaves persona_id = '' so the session inherits the global default.
+type createSubSessionRequest struct {
+	PersonaID string `json:"personaId"`
+}
+
 // handleCreateSubSession creates a new sub session and returns its sessionId. It is a
-// user-side write, so it is owner/admin-gated like /api/v1/chat.
+// user-side write, so it is owner/admin-gated like /api/v1/chat. An optional
+// {"personaId":"..."} body binds the new session to that role; an unknown id is
+// rejected with 400 rather than creating a session that would silently answer as
+// the default role.
 func (s *Server) handleCreateSubSession(w http.ResponseWriter, r *http.Request) {
 	if s.history == nil {
 		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
@@ -111,13 +139,30 @@ func (s *Server) handleCreateSubSession(w http.ResponseWriter, r *http.Request)
 	if claims, ok := auth.ClaimsFromContext(r.Context()); ok {
 		ownerID = claims.Sub
 	}
-	id, err := s.history.NewSubSession(r.Context(), ownerID)
+	var req createSubSessionRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil && !errors.Is(err, io.EOF) {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
+		return
+	}
+	personaID := strings.TrimSpace(req.PersonaID)
+	if !s.requireKnownPersona(w, personaID) {
+		return
+	}
+	id, err := s.newSubSession(r.Context(), ownerID, personaID)
 	if err != nil {
+		if errors.Is(err, errPersonaBindingUnsupported) {
+			writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话角色绑定需要支持 personaId 的 HistoryStore", HTTPCode: http.StatusNotImplemented})
+			return
+		}
 		s.log.Error("history create sub session", "err", err)
 		writeError(w, apperr.Wrap(apperr.ErrInternal, "session_failed", "failed to create session"))
 		return
 	}
-	writeJSON(w, http.StatusCreated, map[string]any{"sessionId": id})
+	resp := map[string]any{"sessionId": id}
+	if personaID != "" {
+		resp["personaId"] = personaID
+	}
+	writeJSON(w, http.StatusCreated, resp)
 }
 
 // handleListMessages returns a page of messages for a session with cursor pagination.
@@ -345,18 +390,19 @@ func (s *Server) handleDeleteSession(w http.ResponseWriter, r *http.Request) {
 // toHistoryMessage maps a stored history.Message to its wire shape.
 func toHistoryMessage(m history.Message) historyMessage {
 	return historyMessage{
-		ID:        m.ID,
-		SessionID: m.SessionID,
-		Role:      m.Role,
-		Content:   m.Content,
-		Mode:      m.Mode,
-		Mood:      m.Mood,
-		Image:     m.Image,
-		Thinking:  m.Thinking,
+		ID:         m.ID,
+		SessionID:  m.SessionID,
+		Role:       m.Role,
+		Content:    m.Content,
+		Mode:       m.Mode,
+		Mood:       m.Mood,
+		Image:      m.Image,
+		Thinking:   m.Thinking,
 		Platform:   m.Platform,
 		DeviceID:   m.DeviceID,
 		SenderName: m.SenderName,
 		AdapterID:  m.AdapterID,
+		PersonaID:  m.PersonaID,
 		CreatedAt:  m.CreatedAt,
 	}
 }