Extension canvas.open emits malformed opened event and does not reliably focus

## Problem

A user-scoped Copilot CLI extension can register and manually render a canvas, but calling the documented low-level `session.rpc.canvas.open` route on resume does not reliably make the canvas visible and emits a malformed event warning in the extension process.

Copilot CLI version: `1.0.71-0` on macOS arm64.

## Reproduction

1. Register a canvas through `joinSession({ canvases: [...], requestCanvasRenderer: true })`.
2. After detecting a resumed session, resolve the canvas through `session.rpc.canvas.list()`.
3. Call `session.rpc.canvas.open` with the exact returned provider ID:

```js
await session.rpc.canvas.open({
extensionId: declared.extensionId,
canvasId: declared.canvasId,
instanceId: "stable-instance",
input: { key: "example" },
});
```

A complete implementation and focused tests are available in [the Session Briefing adapter](https://github.com/scotttesler/dotfiles/blob/017f0d30d7c8beb4913634e3a4ffdfbe17e83547/agents/copilot/extensions/session-briefing/adapter.mjs) and [its test](https://github.com/scotttesler/dotfiles/blob/017f0d30d7c8beb4913634e3a4ffdfbe17e83547/agents/copilot/extensions/session-briefing/adapter.test.mjs).

## Actual behavior

- The `canvas.open` promise resolves; the extension's bounded failure diagnostic does not run.
- The extension process logs `failed to deserialize session.canvas.opened payload`.
- The resumed CLI does not reliably show/focus the canvas.
- The SDK rejects the event because the payload does not satisfy `OpenCanvasInstance` (provider identity, instance/canvas IDs, `reopen`, and `availability`).

## Expected behavior

The returned/opened snapshot and `session.canvas.opened` event satisfy the bundled SDK schema, and reopening a stable instance visibly focuses the canvas.

## Additional evidence

- The same canvas renders successfully when opened through the host's `open_canvas` tool with the explicit provider ID.
- Omitting `extensionId` and passing the exact ID returned by `canvas.list()` both produce the malformed-event warning.
- The canvas ID is unique in the session.

A small diagnostic option to log or expose the rejected event shape would also make this class of failure much easier to debug without instrumenting the SDK.

從 Session Briefing adapter 及其 adapter.test.mjs 開始，接著追蹤 session.rpc.canvas.open route 和 session.canvas.opened event 的處理。將返回的 snapshot 和 event 與隨附的 OpenCanvasInstance schema 進行比較。當 event 成功反序列化，且重新開啟一個穩定的 instance 時 canvas 能明顯取得焦點，即表示完成。

由索引模型根據 Issue 內容生成。