refactor(sync): replace the session-status setState monkeypatch with an owned API

The global session-status store patched its own setState to derive
active membership for callers replacing statusById — a boundary that
silently trusted any caller passing both fields to keep them consistent.
replaceGlobalSessionStatusById is now the one sanctioned way to swap the
map from outside the event reducers; the runtime-switch reset and the
tests that replaced the map directly go through it, and the patch is
gone. Follow-up to #3126 review.

packages/ui/src/sync/global-session-status.test.ts

@@ -5,12 +5,13 @@ import {
   applyGlobalSessionStatusEvents,
   applyGlobalSessionStatusSnapshot,
   useGlobalSessionStatusStore,
+  replaceGlobalSessionStatusById,
 } from "./global-session-status"
 import { resetSessionOrdering, useSessionOrderingStore } from "./session-ordering"
 import { resetSessionActivityTiming, useSessionActivityTimingStore } from "./session-activity-timing"
 
 beforeEach(() => {
-  useGlobalSessionStatusStore.setState({ statusById: new Map() })
+  replaceGlobalSessionStatusById(new Map())
   resetSessionOrdering()
   resetSessionActivityTiming()
 })
@@ -162,7 +163,7 @@ describe("global session status index", () => {
       properties: { sessionID: "session-a", status: { type: "busy" } },
     } as Event)
 
-    useGlobalSessionStatusStore.setState({ statusById: new Map() })
+    replaceGlobalSessionStatusById(new Map())
 
     expect(activeSessionIds()?.size).toBe(0)
   })