Fix broadcast handler blocking event delivery in multi-client scenario

Keep broadcast handlers fire-and-forget (matching original behavior) while
serializing user event handler dispatch. A stalled broadcast handler (e.g.,
a secondary client whose permission handler intentionally never completes)
must not block event delivery to user code.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: stephentoub

dotnet/src/Session.cs

@@ -306,25 +306,19 @@ internal void DispatchEvent(SessionEvent sessionEvent)
 
     /// <summary>
     /// Single-reader consumer loop that processes events from the channel.
-    /// Ensures all user code — event handlers, tool handlers, permission handlers —
-    /// is invoked serially and in FIFO order. Broadcast work (tool calls, permission
-    /// requests) is awaited inline before dispatching to user handlers.
+    /// Ensures user event handlers are invoked serially and in FIFO order.
+    /// Broadcast work (tool calls, permission requests) is fired concurrently
+    /// so that a stalled handler does not block event delivery to user code.
     /// </summary>
     private async Task ProcessEventsAsync()
     {
         await foreach (var sessionEvent in _eventChannel.Reader.ReadAllAsync())
         {
-            // Await broadcast work inline so tool/permission handlers are serialized
-            // with everything else. If two tool requests arrive back-to-back, the second
-            // won't start until the first completes.
-            try
-            {
-                await HandleBroadcastEventAsync(sessionEvent);
-            }
-            catch (Exception ex) when (ex is not OperationCanceledException)
-            {
-                LogBroadcastHandlerError(ex);
-            }
+            // Fire broadcast work concurrently (fire-and-forget with error logging).
+            // This preserves the pre-existing behavior where broadcast handlers do not
+            // block event delivery — important when a secondary client's handler
+            // intentionally never completes (multi-client permission scenario).
+            _ = HandleBroadcastEventSafe(sessionEvent);
 
             // Invoke user handlers serially. Catch exceptions per handler to keep the
             // loop alive and ensure all subscribers see the event even if one fails.
@@ -346,6 +340,22 @@ private async Task ProcessEventsAsync()
         }
     }
 
+    /// <summary>
+    /// Wraps <see cref="HandleBroadcastEventAsync"/> with error logging so it can
+    /// be safely fire-and-forget.
+    /// </summary>
+    private async Task HandleBroadcastEventSafe(SessionEvent sessionEvent)
+    {
+        try
+        {
+            await HandleBroadcastEventAsync(sessionEvent);
+        }
+        catch (Exception ex) when (ex is not OperationCanceledException)
+        {
+            LogBroadcastHandlerError(ex);
+        }
+    }
+
     /// <summary>
     /// Registers custom tool handlers for this session.
     /// </summary>