Hookshot fails to start against Synapse 1.161.0 after removal of the MSC3202 device_id alias

### Description

After upgrading Synapse from v1.160.0 to v1.161.0, Hookshot crash-loops during encrypted appservice setup.

Synapse v1.161.0 removed support for the deprecated `org.matrix.msc3202.device_id` application-service masquerading query parameter (https://github.com/element-hq/synapse/pull/20192). The image published as `latest`/`main` bundles `@vector-im/matrix-bot-sdk@0.8.0-element.3`, which still sends only the removed parameter.

### Environment

- Hookshot image: `ghcr.io/matrix-org/matrix-hookshot:latest` (7.4.4; the `main` tag currently resolves to the same image)
- matrix-bot-sdk: `@vector-im/matrix-bot-sdk@0.8.0-element.3`
- Node.js: v22.23.2
- Synapse: v1.161.0
- Hookshot encryption: enabled (`encryption.storagePath` configured)
- Auth delegated to Matrix Authentication Service: yes
- Redis storage: enabled

### Logs

Hookshot reaches the homeserver, sets up the bot user, then fails while setting up encryption:

```text
[Bridge] Ensuring homeserver can be reached...
[BotUsersManager] Ensuring bot users are set up...
[Appservice] Failed to set up crypto on intent @hookshot:example.com
MatrixError: M_UNRECOGNIZED: Unrecognized request
statusCode: 404
```

The container then exits and restarts.

### Analysis

The bundled SDK appends `org.matrix.msc3202.device_id=...` to requests from impersonated intents (`MatrixClient.doRequest()`). Synapse v1.161.0 no longer recognises this parameter, so the SDK's `whoami` check does not see the expected device ID. It then falls back to an application-service login, which fails with `404 M_UNRECOGNIZED` on this homeserver (auth is delegated to MAS, so `/login` is not served).

Downgrading Synapse to v1.160.0 restores a normal startup, with no changes to the Hookshot configuration or crypto store.

### Expected behaviour

Encrypted Hookshot should initialise against Synapse v1.161.0 using the stable `device_id` parameter.

### Additional notes

Newer published releases of `@vector-im/matrix-bot-sdk`, including the current latest (0.10.0-element.0), still send the prefixed parameter, so bumping Hookshot's dependency alone will not fix this. I've opened a matching issue against the SDK and will link it below.

Start by tracing encrypted appservice setup and the impersonated-intent requests through MatrixClient.doRequest(), then review the linked matrix-bot-sdk issue. Reproduce the startup failure against Synapse 1.161.0 with encryption enabled and MAS authentication; done means Hookshot starts successfully using the stable device_id parameter without falling back to /login.

Written by the indexing model from the issue text.