Summary

Builds on the merged form service/routes (#35094, #35099) to support the temporary "global" form owner needed by MCP elicitation (which lands separately in #35108). The goal is to minimize public surface area: no new endpoints, no wire contract changes — the hack is hidden in a type loosening and a middleware branch.

• Form.Info.sessionID is temporarily a plain string. It should be typed as SessionID, and the schema comment says exactly that: the only reason it is a string is the "global" sentinel owner for MCP elicitation, which is not a real session. Revert to SessionID once elicitations can be attributed to real sessions. Same for the form.replied/form.cancelled event payloads.
• FormLocationMiddleware replaces SessionLocationMiddleware on the existing session-scoped form routes (same paths, same shapes). It treats real session IDs exactly like SessionLocationMiddleware (decode, session-row lookup, session's location services) and has one undocumented branch: sessionID === "global" bypasses the row lookup and resolves location services from the request, like LocationMiddleware. This mirrors the approach from the original (reverted) form service commit.
• Form route params decode as plain strings so the sentinel can reach the middleware; invalid real session IDs still fail with InvalidRequestError/SessionNotFoundError as before.

Zero generated churn in client/plugin/SDK surfaces — verified via check:generated and a full SDK regeneration producing byte-identical output.

Also fixes packages/client/test/promise.test.ts, which was already failing on v2 (#35099 forgot to add form to the expected client group list).

Verification

• bun typecheck in packages/schema, packages/core, packages/protocol, packages/server, packages/client, packages/sdk/js, packages/opencode
• bun test test/form.test.ts in packages/core
• bun test test/event-manifest.test.ts in packages/schema
• bun test test/promise.test.ts + bun run check:generated in packages/client
• HttpApi exerciser form scenarios pass through the new middleware (--include v2.session.form: 6/6)