[codex] Fix event store replay isolation

[jlowin]

Streamable HTTP resumability stored events in one shared backend keyed only by the SDK stream id. Those ids are scoped to an SDK transport rather than globally unique, so separate client sessions could share _GET_stream or the same request id and allow reconnect replay to cross a session boundary.

This PR adds a session-scoped EventStore adapter and gives each Streamable HTTP transport its own adapter while preserving the shared storage backend. Replay now buffers events until it verifies that the resolved stream id belongs to the current session scope, then returns the original SDK stream id so transport behavior remains unchanged.

event_store = EventStore()
session_a = SessionScopedEventStore(event_store, "session-a")
session_b = SessionScopedEventStore(event_store, "session-b")

With overlapping stream ids, session_a.replay_events_after(...) now emits only events stored through session_a.