refactor: address Phase-2 review findings on /new boundary handoff

- Return the boundary snapshot from
  _launch_session_boundary_memory_flush as a local value instead of
  staging it on self._session_boundary_snapshot. The instance-attr
  handoff could leak (no memory manager configured) or mis-fire a
  stale snapshot on a later /new if an exception hit between staging
  and consumption. A local variable eliminates the class; the helper
  also returns None when no memory manager is configured so
  new_session takes the inline-switch path.
- Drop the now-dead session_id kwarg from commit_memory_session:
  after the redesign no production caller passes it (gateway, TUI,
  compression all use the default), and speculative params are
  rejected per AGENTS.md. The explicit-old-session need is served by
  cli.py's direct engine call + commit_session_boundary_async.
- Drop the dead providers snapshot in commit_session_boundary_async
  (only the emptiness check used it).
- Tests updated accordingly (dead-kwarg test removed, snapshot
  assertion now covered by return-value contract).

Phase-2 gates: 2a tests/cli 1048 passed + 6 memory files 137 passed;
2b programmatic live smoke 0.38ms non-blocking caller, end→switch→sync
ordering verified; 2c structured 4-angle review — no Criticals, these
warnings fixed.

tests/cli/test_cli_new_session.py

@@ -194,8 +194,6 @@ def test_new_session_queues_boundary_commit_with_snapshot(tmp_path):
     assert kwargs["reason"] == "new_session"
     # The queued path replaces the inline switch — not both.
     mm.on_session_switch.assert_not_called()
-    # Snapshot is consumed (a later /new without history must not re-send it).
-    assert cli._session_boundary_snapshot is None
 
 
 def test_new_session_without_history_switches_inline(tmp_path):