fix(gateway): preserve document type when merging queued events

[teknium1]

Salvage of #16589 by @hharry11 onto current main.

Summary

Cherry-picked on top of current main (branch was 621 commits behind). Clean pick, no conflicts, authorship preserved.

What the fix does

In merge_pending_message_event, when a queued TEXT event absorbs an incoming non-text media event (DOCUMENT, AUDIO, VIDEO), promote the merged event's message_type to the incoming type. Existing PHOTO precedence is untouched.

Why it matters

Session busy → user sends text → user sends a PDF/audio/video. The queued event kept message_type=TEXT even after inheriting the document's media_urls/media_types. Downstream gateway/run.py:5157 gates document content-injection on message_type == DOCUMENT, so the agent received only a bare file path with no context note.

Validation

• Targeted suite: tests/gateway/test_session_race_guard.py 17/17 pass (includes new regression test)
• Live E2E against real imports (isolated HERMES_HOME): 8/8 scenarios pass
  • text → doc: promoted to DOCUMENT, text+media preserved, downstream handler fires
  • text → photo: stays PHOTO (precedence unchanged)
  • text → text: burst merge preserved
  • text → audio, text → video: fix generalizes correctly
  • photo → photo album, doc → doc burst, empty → doc: all baseline paths intact

Closes #16589.