app-server: harden realtime tests against nondeterminism

Motivation:
Realtime tests were sensitive to deterministic JSON object key order in multipart request bodies and exact shell output in delegated command execution. Neither behavior is part of the contract those tests are intended to validate.

Summary:
Compare the multipart session payload as parsed JSON while preserving the SDP framing checks, and assert delegated shell output contains the expected command result instead of requiring an exact string match.

Testing:
- cargo test -p codex-app-server --test all realtime_webrtc_start_emits_sdp_notification
- cargo test -p codex-app-server --test all webrtc_v1_start_posts_offer_returns_sdp_and_joins_sideband
- cargo test -p codex-app-server --test all webrtc_v2_tool_call_delegated_turn_can_execute_shell_tool
- cargo test -p codex-app-server