Close out the last review edge-cases before final merge

The remaining review threads were down to route alias hygiene, proxy-safe header
ordering, and a Gemini canonical tool-result mismatch. This commit makes the
alias/websocket behavior explicit, preserves contributor helper safety, and
teaches the canonical Gemini path to recover tool names and wrap function
results the same way the OpenAI-shaped path already does.

Constraint: Keep the last review fixes limited to the current branch so the release PR stays easy to reason about
Rejected: Defer the Gemini canonical fix to a later refactor | the review found a real functional mismatch and the fix stayed localized to the request bridge
Confidence: high
Scope-risk: narrow
Directive: Keep canonical-to-provider bridges internally consistent; if one path resolves tool names or wraps results, the sibling path should not diverge silently
Tested: Focused vitest for Gemini request bridge, route aliases, upstream request builder, responses response bridge, contributor updater; typecheck; git diff --check
Not-tested: Full npm test; any broader end-to-end Gemini live-provider behavior outside the covered bridge tests

src/server/routes/proxy/responsesWebsocket.ts

@@ -552,8 +552,8 @@ async function handleResponsesWebsocketConnection(
   request: IncomingMessage,
   authContext: ResponsesWebsocketAuthContext,
 ) {
-  const websocketSessionId = headerValueToTrimmedString(request.headers['session_id'])
-    || headerValueToTrimmedString(request.headers['session-id'])
+  const websocketSessionId = headerValueToTrimmedString(request.headers['session-id'])
+    || headerValueToTrimmedString(request.headers['session_id'])
     || headerValueToTrimmedString(request.headers['conversation-id'])
     || headerValueToTrimmedString(request.headers['conversation_id'])
     || randomUUID();