feat(session,runtime): 多角色并存—按会话选角（迁移0011 + 按回合解析 + agent池 + 提取器修正）

按 DevDocs/design/22 批次 1 后端（§2/§3/§4.1-4.5/§4.7/§5 验收 1-6）。
- 迁移 0011：chat_sessions.persona_id + chat_messages.persona_id（均 DEFAULT ''，无回填 → 升级零风险）；同步包内幂等 DDL；**真实库升级验证**（拷贝 data/cyrene.db 到临时目录跑 MigrateUp：既有 1 会话/109 消息 persona 仍为 ''，原库未被触碰）
- history：SessionMeta/Message 加 PersonaID + SetSessionPersona；ListSessions/List/scan/Append 带上
- runtime：SessionEnv.PersonaID + loop.personaFor(ctx) 替换固定 l.personaID（memory/request/turn）+ **agent 池**（Options.Agents，按角色取 instructions，未命中回落）+ **提取器不再把 persona 烤死在构造期**（多角色下记忆不再永远记在 cyrene 名下）+ **thinking 旋钮改为按会话角色解析**（否则角色 Y 会用角色 X 的预算/展示）
- gateway：会话 DTO/POST/PATCH 支持 personaId；ws/rest/voice 的 OwnerEnv 硬编改为**按会话解析角色**（actor 元数据语义不变）；admin memories 搜索去掉硬编 cyrene
- Docs/api-client v0.42；**两处有意的行为收紧**已写明：POST /sessions body 非法 JSON → 400（原先完全忽略 body；空/null/{} 仍 201）；POST /admin/memories/search 省略 personaId 且无默认角色 → 400（原先默认查 cyrene）
- 测试：design/22 §5 验收 1-6（记忆隔离/提示词首条 system/情绪按角色/提取 persona 归属/迁移兼容）+ 进程内 e2e（断言 adapter 收到的 model.Request.Messages[0] 即该角色的 systemPrompt）
- **已知未做（留批次 2 / 待确认）**：① IM 与渠道级未做 → **§7-3「owner 私聊镜像随主会话角色」尚未生效**；② 请求级覆盖未实现（本批只做会话级）；③ **§7-5 的「上下文发送角色标记」只完成存储+DTO 半边**——消息 persona 已落库且 DTO 已带，但模型上下文不从 chat_messages 重建，「第 N 条是谁说的」尚未进上下文（需确认是否属批次 2）；④「切角色重建摘要」当前是空操作（压缩未接线）；⑤ thinking 旋钮仅在流式路径生效（非流式 agent.RunStep 不带，A 批次既有性质）
- 验收：go build/vet/test 全绿 + linux/amd64 与 darwin/arm64 交叉编译（既有 flake 本轮未触发；同批 session_orchestrator.go 一度 501 行 → 抽出 session_tail.go）

internal/services/gateway/history_write.go

@@ -19,12 +19,15 @@ import (
 // broadcast their outcome over the WS hub (message_edited / message_deleted, see
 // ws_hub.go) so the account's other browsers stay in sync without a manual re-read.
 
-// patchSessionRequest is the PATCH /api/v1/sessions/{id} body. Both fields are pointers
-// so an absent field is distinguishable from an explicit zero value: title renames the
-// session (A4), pinned sets/unets the pin (D5), and at least one must be present.
+// patchSessionRequest is the PATCH /api/v1/sessions/{id} body. All fields are
+// pointers so an absent field is distinguishable from an explicit zero value:
+// title renames the session (A4), pinned sets/unets the pin (D5), personaId
+// rebinds the session's role (design/22 §4.5, an explicit "" clears the binding
+// back to "inherit the global default"), and at least one must be present.
 type patchSessionRequest struct {
-	Title  *string `json:"title"`
-	Pinned *bool   `json:"pinned"`
+	Title     *string `json:"title"`
+	Pinned    *bool   `json:"pinned"`
+	PersonaID *string `json:"personaId"`
 }
 
 // maxSessionTitleRunes bounds a client-supplied session title so a display row never
@@ -32,12 +35,16 @@ type patchSessionRequest struct {
 // the title (project red line).
 const maxSessionTitleRunes = 80
 
-// handlePatchSession updates a persistent session's display metadata: its title (A4)
-// and/or its pinned flag (D5). Both are display/order-only, so unlike DELETE they are
-// allowed on the fixed main session. A request carrying neither field answers 400, as
-// do an empty/whitespace or over-long title; an unknown session id answers 404. It is
-// owner/admin-gated like the other history writes. The response echoes only the fields
-// that were changed, so a title-only PATCH keeps its pre-D5 {id,title} shape.
+// handlePatchSession updates a persistent session's display metadata — its title
+// (A4), its pinned flag (D5) — and/or its role binding (design/22 §4.5). All three
+// are metadata: unlike DELETE they are allowed on the fixed main session. A request
+// carrying none of the fields answers 400, as do an empty/whitespace or over-long
+// title and an unknown personaId; an unknown session id answers 404. Rebinding a
+// role does not touch the stored conversation — the messages keep the role that
+// spoke them (design/22 §7-5) — it only changes which role answers from the next
+// turn on. It is owner/admin-gated like the other history writes. The response
+// echoes only the fields that were changed, so a title-only PATCH keeps its pre-D5
+// {id,title} shape.
 func (s *Server) handlePatchSession(w http.ResponseWriter, r *http.Request) {
 	if s.history == nil {
 		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
@@ -53,8 +60,8 @@ func (s *Server) handlePatchSession(w http.ResponseWriter, r *http.Request) {
 		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
 		return
 	}
-	if req.Title == nil && req.Pinned == nil {
-		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title or pinned is required"))
+	if req.Title == nil && req.Pinned == nil && req.PersonaID == nil {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title, pinned or personaId is required"))
 		return
 	}
 	resp := map[string]any{"id": id}
@@ -81,16 +88,43 @@ func (s *Server) handlePatchSession(w http.ResponseWriter, r *http.Request) {
 		}
 		resp["pinned"] = *req.Pinned
 	}
+	if req.PersonaID != nil {
+		personaID := strings.TrimSpace(*req.PersonaID)
+		if !s.requireKnownPersona(w, personaID) {
+			return
+		}
+		if err := s.setSessionPersona(r.Context(), id, personaID); err != nil {
+			s.writeSessionPatchError(w, err, id, "set session persona")
+			return
+		}
+		resp["personaId"] = personaID
+	}
 	writeJSON(w, http.StatusOK, resp)
 }
 
-// writeSessionPatchError maps a RenameSession/SetPinned failure to its response:
-// ErrSessionNotFound → 404, anything else → 500 (logged under op).
+// setSessionPersona rebinds a session's role through the store's optional
+// role-writer. A store without it answers 501 rather than reporting a binding that
+// was never written.
+func (s *Server) setSessionPersona(ctx context.Context, sessionID, personaID string) error {
+	writer, ok := s.history.(sessionPersonaWriter)
+	if !ok {
+		return errPersonaBindingUnsupported
+	}
+	return writer.SetSessionPersona(ctx, sessionID, personaID)
+}
+
+// writeSessionPatchError maps a RenameSession/SetPinned/SetSessionPersona failure to
+// its response: ErrSessionNotFound → 404, a store that cannot bind roles → 501,
+// anything else → 500 (logged under op).
 func (s *Server) writeSessionPatchError(w http.ResponseWriter, err error, id, op string) {
 	if errors.Is(err, history.ErrSessionNotFound) {
 		writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "session %q not found", id))
 		return
 	}
+	if errors.Is(err, errPersonaBindingUnsupported) {
+		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话角色绑定需要支持 personaId 的 HistoryStore", HTTPCode: http.StatusNotImplemented})
+		return
+	}
 	s.log.Error(op, "err", err, "session", id)
 	writeError(w, apperr.Wrap(apperr.ErrInternal, "session_failed", "failed to update session"))
 }