Fix Go broadcast handler blocking event delivery

Fire broadcast handlers (tool/permission) in separate goroutines while
keeping user event handlers serialized on the consumer goroutine. This
prevents a stalled broadcast handler (e.g., a secondary client whose
permission handler intentionally never completes) from blocking event
delivery to user code — matching the fire-and-forget semantics of
Node.js and Python SDKs.

The consumer goroutine (processEvents) still runs off the readLoop,
so RPC deadlocks are also avoided.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: stephentoub

go/session.go

@@ -461,14 +461,16 @@ func (s *Session) dispatchEvent(event SessionEvent) {
 }
 
 // processEvents is the single-goroutine consumer loop that processes events
-// from the channel. Ensures all user code — event handlers, tool handlers,
-// permission handlers — is invoked serially and in FIFO order. Broadcast work
-// (tool calls, permission requests) completes before user handlers see the event.
+// from the channel. Ensures user event handlers are invoked serially and in
+// FIFO order. Broadcast work (tool calls, permission requests) is fired
+// concurrently so that a stalled handler does not block event delivery.
 func (s *Session) processEvents() {
 	for event := range s.eventCh {
-		// Handle broadcast request events (serialized with user handlers).
-		// Runs off the readLoop goroutine so RPC requests won't deadlock.
-		s.handleBroadcastEvent(event)
+		// Fire broadcast handlers in a separate goroutine so they don't block
+		// event delivery. This preserves pre-existing fire-and-forget semantics
+		// (important when a secondary client's handler intentionally never
+		// completes), while running off the readLoop to avoid deadlocks.
+		go s.handleBroadcastEvent(event)
 
 		s.handlerMutex.RLock()
 		handlers := make([]SessionEventHandler, 0, len(s.handlers))
@@ -494,8 +496,9 @@ func (s *Session) processEvents() {
 // and responding via RPC. This implements the protocol v3 broadcast model where tool
 // calls and permission requests are broadcast as session events to all clients.
 //
-// Handlers are executed on the processEvents goroutine (not the JSON-RPC read loop)
-// so that RPC responses can be received without deadlocking.
+// Handlers are executed in their own goroutine (not the JSON-RPC read loop or the
+// event consumer loop) so that a stalled handler does not block event delivery or
+// cause RPC deadlocks.
 func (s *Session) handleBroadcastEvent(event SessionEvent) {
 	switch event.Type {
 	case ExternalToolRequested: