feat(dsh): capture effective route from durable request evidence

[Altairpaca]

Why

#46 now has a host-agnostic requested/resolved/effective contract, but effective must be populated from runtime evidence rather than inferred from policy or UI state. DSHelm already has an authoritative keyless execution contract built around the durable DSH request/header; this increment turns that evidence into a production observation helper.

Change

• add observeEffectiveRouteFromSession() in @dshelm/dsh;
• scan the stable Session log snapshot for the latest valid durable request/header;
• extract actual provider/model/reasoning into EffectiveRouteObservation;
• retain resolved/requested/cause metadata without using it as a substitute for missing runtime evidence;
• return undefined when no valid runtime header exists;
• keep event parsing structural so the helper does not couple to one DSH SessionEvent declaration generation;
• extend the existing real DSH keyless request contract to assert that the produced observation equals both the adapter's actual GenerateOptions and the durable request header;
• cover explicit override classification and the no-I/O/no-fabrication case.

Evidence boundary

This proves capture from the DSH session request record used by the real AgentLoop fixture. It does not yet persist observations into the parent control-plane projection, render them in the Web UI, infer dollar cost, or emit escalation warnings.

Refs #46 #31 #32.