Optional bridge. When present (with a non-null session) every
callTool dispatches inside bridge.runScoped(session, ...),
so the in-process handler's DispatchContext.scopeId lookups
auto-prefix local ids with the active session's bundleId.
Pre-bridge AppPlayer hosts (or tests) leave both null and
dispatch falls back to direct callInProcess.
Verbs exposed to JS. The bridge installs one JS function per verb
on host.<key>. Empty list = no methods (the atom registers but
JS calls always fail).
Dispatch a verb invocation. Returns any JSON-serialisable value
(or a Future thereof) — the bridge JSON-encodes and hands back to
the JS Promise. Throw to reject the promise.