[SDK-006] Add gateway session manager

[AdeGneus]

Context

The Gateway needs reusable lifecycle semantics for request correlation, timeout, and retries over MQTT without reimplementing contract rules ad hoc.

Scope

• Create ori_sdk/gateway_session.py.
• Implement GatewaySession, GatewaySessionError, and ActiveSessionRegistry.
• Preserve request ID across retries.
• Add timeout eviction tests.

Non-Goals

• Does not open MQTT connections.
• Does not execute provider logic.

Technical Specification

GatewaySession.next_attempt() preserves request_id; is_correlated(response) delegates to response/request match logic; registry evicts timed-out sessions deterministically.

Acceptance Criteria

• Session lifecycle is deterministic.
• Retries preserve request IDs.
• Timeout and exhaustion errors are typed.
• pytest, mypy, and ruff pass.

Tests Required

Test	Verifies
test_session_correlates_response	Response matching works.
test_next_attempt_preserves_request_id	Retry invariant.
test_registry_evicts_timed_out	Timeout eviction.

Additional Test Coverage / Edge Cases

• Verify retries preserve the original request_id across all attempts.
• Verify timeout eviction removes only expired sessions and leaves active sessions intact.
• Verify duplicate request IDs are rejected or overwrite deterministically by documented policy.
• Verify response correlation rejects wrong request ID, wrong device ID, and malformed response payloads.
• Test concurrent registry access if registry is intended to be thread-safe/async-safe.

Invariants — Do Not Violate

• Gateway request IDs are stable across retries.

Dependencies

Blocked by:

• Nothing

Unblocks:

• Nothing

Contract References

• ori-specs/gateway-api/v1.md
• SDK gateway models

Priority

post-poc

Suggested Labels

ready, post-poc