feat(security): behavioral circuit breaker with containment

**Context:** ROADMAP.md → Security → Behavioral circuit breaker
**Related:** #390, #428, #251, emergency-session-containment draft

---

## Component

Agent (Python runtime)

## Describe the feature

Per-session limits on:

- **Tool-call rate**
- **Cumulative cost**
- **Consecutive failures**
- **File churn**

On trip: pause or **terminate** session, **revoke short-lived credentials** where applicable, emit **`containment` audit event**. Configurable per repo via Blueprint (`SECURITY.md`, `REPO_ONBOARDING.md`).

**Design principle:** prefer hard containment over friction-only limits (rate/turn caps alone). Pairs with emergency session containment APIs.

## Use case

Runaway agents (infinite tool loops, runaway edits, budget burn) need automated stop—not just logging. Operators want repo-specific thresholds aligned with risk.

## Proposed solution

1. In-agent monitor (hooks + runner) tracking rolling windows.
2. Blueprint thresholds per signal; defaults conservative.
3. On trip: call orchestrator containment path → emergency session containment APIs.
4. `containment` event to `TaskEventsTable`; optional Slack/GitHub notify.
5. Tests for each trip reason and recovery (operator resume).

## Other information

- #390/#428 are adjacent RFCs; this is the **productized circuit breaker**.
- Design context: `docs/design/SECURITY.md`, `docs/design/REPO_ONBOARDING.md`.

- [ ] This might be a breaking change

Lies ROADMAP.md und den Designkontext in docs/design/SECURITY.md und docs/design/REPO_ONBOARDING.md, und verfolge dann die Agent-Hooks, den Runner, den Containment-Pfad des Orchestrators, die APIs zur Containment-Notfallsitzung und TaskEventsTable. Definiere und teste jeden Auslösegrund, das Verhalten bei Credential-Widerruf und Containment-Ereignissen, Benachrichtigungsoptionen sowie die Wiederherstellung beim Fortsetzen durch den Operator.

Vom Indexierungsmodell aus dem Issue-Text verfasst.