fix(a2a): validate session_id at entry of _handle_session_close before devcontainer cleanup

Move the session_id validation to the top of _handle_session_close so that
no downstream code path (including _cleanup_session_devcontainers) receives
an empty or missing session_id. Previously, when session_id was absent the
check only ran after accessing svc.delete(), allowing cleanup to proceed
with a blank value in the null-service fallback path.

Signed-off-by: CleverThis <hal9000@cleverthis.com>

src/cleveragents/a2a/facade.py

@@ -354,6 +354,9 @@ class A2aLocalFacade:
     def _handle_session_close(self, params: dict[str, Any]) -> dict[str, Any]:
         session_id = params.get("session_id", "")
 
+        if not session_id:
+            raise ValueError("session_id is required")
+
         svc = self._session_service
         if svc is None:
             # R7-F4 fix: still run container cleanup even without a
@@ -361,8 +364,6 @@ class A2aLocalFacade:
             self._cleanup_session_devcontainers(session_id)
             return {"status": "closed"}
 
-        if not session_id:
-            raise ValueError("session_id is required")
         svc.delete(session_id)
 
         # R7-F4 fix: run container cleanup after session deletion.