Merge origin/master (SessionFace contract) into web-permission-sandbox-merge-master

Three ui-conversation spec conflicts resolve to master's SlotTestRuntime
rewrites. Adaptation to the new outward session face: ISession gains the
command verb (the composer chip and the /permission picker submit through
it), FixtureSession grows the matching fail-loud stub plus the
waitingApproval summary default, and the picker reads the projection
through projections.faceOf (the ProjectionsFace shape) instead of the
retired store getter.

packages/client/ui-permission/tests/browser-plugin.spec.ts

@@ -38,7 +38,12 @@ async function bench() {
   const commands: string[] = []
   let commandResult: { ok: boolean; matched?: boolean } = { ok: true, matched: true }
   const session = (id: SessionId) => ({
-    projections: { get: (key: string) => (key === 'permissions' ? values.get(id) : undefined) },
+    projections: {
+      faceOf: (key: string) => ({
+        getSnapshot: () => (key === 'permissions' ? values.get(id) : undefined),
+        subscribe: () => () => {},
+      }),
+    },
     command: (line: string) => {
       commands.push(line)
       return Promise.resolve(commandResult.ok