Function BuildSessionPayload

Builds the provider session payload (minus model, tools and the GA features, which the caller adds). Both topologies call this — the client-direct mint and the server-bridged session.update — so the payload is built once and a raw audio override in the Config bag merges into the built block (via MergeAudioOverride) instead of replacing it.

audio is stripped from the residual bag before it is spread so it cannot overwrite the merged block; the other protected wire fields are already scrubbed by ExtractRealtimeFeatures.