fix: guard finalizeThinkingCard with session ID check

[JKJameson]

Without this check, switching browser tabs while a stream is running causes finalizeThinkingCard() to operate on the wrong session's thinking card DOM, the card belongs to the stream that started it, not the session currently displayed in the tab. The guard ensures finalize only runs when the live assistant turn's session matches the current session.

[nesquena-hermes]

Shipped in v0.50.250 via batch release PR #1368 (merge ffd11037). Thanks @JKJameson! 🙏

Live at https://github.com/nesquena/hermes-webui/releases/tag/v0.50.250.

What landed

Your guard at finalizeThinkingCard() ships, paired with three pre-release fixes the release agent and Opus identified during review:

1. Per-site dataset.sessionId stamps. Your guard reads _guardTurn.dataset.sessionId and compares against S.session.session_id, but no code in the repo set that attribute. Without the stamps, the guard's comparison was always undefined !== "<sid>" (always true), and finalizeThinkingCard() always early-returned — every assistant turn's thinking card would have stayed open forever. The release agent added if(S.session) <var>.dataset.sessionId=S.session.session_id; at all 3 sites in static/ui.js that create liveAssistantTurn (lines ~3179, 3551, 4339).

2. Regression test (tests/test_pr1366_finalize_thinking_card_guard.py). Walks static/ui.js with regex, finds every <var>.id='liveAssistantTurn' assignment, and asserts a matching <var>.dataset.sessionId= stamp follows within ~500 chars. If a future PR adds a 4th creation site without the stamp, this test fails with a clear error message. Locks the invariant in.

3. Behavioral verification. Live runtime check via the new SSE liveness section in webui_qa_agent.sh confirmed the streaming UI works correctly post-deploy.

Known limitations (tracked as follow-ups)

Opus flagged that the guard catches the stale-A-turn-in-DOM case (your scenario) but does NOT fully prevent A's late callback from finalizing B's thinking card when both A and B have live streams concurrently. A complete fix would have finalizeThinkingCard(streamSessionId) accept the stream's session_id as a parameter. Out of scope for this release; what shipped is a strict improvement over master.

Lessons captured in ~/WebUI/docs/agent-memory/sse-handler-pre-release.md (now: any guard that depends on a DOM/state attribute must be paired with a regression test that pins the attribute setters).