Extension canvas.open emits malformed opened event and does not reliably focus

## Problem

A user-scoped Copilot CLI extension can register and manually render a canvas, but calling the documented low-level `session.rpc.canvas.open` route on resume does not reliably make the canvas visible and emits a malformed event warning in the extension process.

Copilot CLI version: `1.0.71-0` on macOS arm64.

## Reproduction

1. Register a canvas through `joinSession({ canvases: [...], requestCanvasRenderer: true })`.
2. After detecting a resumed session, resolve the canvas through `session.rpc.canvas.list()`.
3. Call `session.rpc.canvas.open` with the exact returned provider ID:

```js
await session.rpc.canvas.open({
extensionId: declared.extensionId,
canvasId: declared.canvasId,
instanceId: "stable-instance",
input: { key: "example" },
});
```

A complete implementation and focused tests are available in [the Session Briefing adapter](https://github.com/scotttesler/dotfiles/blob/017f0d30d7c8beb4913634e3a4ffdfbe17e83547/agents/copilot/extensions/session-briefing/adapter.mjs) and [its test](https://github.com/scotttesler/dotfiles/blob/017f0d30d7c8beb4913634e3a4ffdfbe17e83547/agents/copilot/extensions/session-briefing/adapter.test.mjs).

## Actual behavior

- The `canvas.open` promise resolves; the extension's bounded failure diagnostic does not run.
- The extension process logs `failed to deserialize session.canvas.opened payload`.
- The resumed CLI does not reliably show/focus the canvas.
- The SDK rejects the event because the payload does not satisfy `OpenCanvasInstance` (provider identity, instance/canvas IDs, `reopen`, and `availability`).

## Expected behavior

The returned/opened snapshot and `session.canvas.opened` event satisfy the bundled SDK schema, and reopening a stable instance visibly focuses the canvas.

## Additional evidence

- The same canvas renders successfully when opened through the host's `open_canvas` tool with the explicit provider ID.
- Omitting `extensionId` and passing the exact ID returned by `canvas.list()` both produce the malformed-event warning.
- The canvas ID is unique in the session.

A small diagnostic option to log or expose the rejected event shape would also make this class of failure much easier to debug without instrumenting the SDK.

Start with the Session Briefing adapter and its adapter.test.mjs, then trace the session.rpc.canvas.open route and the session.canvas.opened event handling. Compare the returned snapshot and event with the bundled OpenCanvasInstance schema. Done means the event deserializes successfully and reopening a stable instance visibly focuses the canvas.

Written by the indexing model from the issue text.