fix request ID normalization collision

[bschwitz3]

Summary

• prevent non-canonical numeric response IDs (for example "01") from being coerced to integer IDs
• avoid response/request routing collisions in shared session handling
• add regression test for non-canonical numeric response ID mismatch

Test plan

• run uv run --frozen pytest tests/shared/test_session.py
• run full suite as needed

[bschwitz3]

Hey @maxisbey , if you have a moment, I’d really appreciate your quick look on this fix, I’d value your feedback. :)
thanks !

[maxisbey]

Thanks for the PR! I dug into this a bit and I think we should hold off.

The removed comment was actually correct — TypeScript uses Number(response.id), and in JavaScript Number("01") === 1, so "01" does match a pending request with integer ID 1 in the TS SDK. This PR would make Python diverge from TypeScript rather than stay aligned.

The collision risk also isn't really there in practice: both SDKs only ever send integer IDs from a monotonic counter (true for client→server and server→client requests — it's shared base-class code on both sides), so there's only ever one pending request with ID 1. A peer returning "01" for it is spec-violating (JSON-RPC requires the response ID to be the same as the request), but there's no second request it could collide with.

If we want to tighten this up, the cleaner direction is probably exact-match-only with a warning on miss — but that's a separate conversation. Closing for now, but happy to discuss further!

_{AI Disclaimer}