feat(security): behavioral circuit breaker with containment

Context: ROADMAP.md → Security → Behavioral circuit breaker
Related: #390, #428, #251, emergency-session-containment draft

Component

Agent (Python runtime)

Describe the feature

Per-session limits on:

• Tool-call rate
• Cumulative cost
• Consecutive failures
• File churn

On trip: pause or terminate session, revoke short-lived credentials where applicable, emit containment audit event. Configurable per repo via Blueprint (SECURITY.md, REPO_ONBOARDING.md).

Design principle: prefer hard containment over friction-only limits (rate/turn caps alone). Pairs with emergency session containment APIs.

Use case

Runaway agents (infinite tool loops, runaway edits, budget burn) need automated stop—not just logging. Operators want repo-specific thresholds aligned with risk.

Proposed solution

1. In-agent monitor (hooks + runner) tracking rolling windows.
2. Blueprint thresholds per signal; defaults conservative.
3. On trip: call orchestrator containment path → emergency session containment APIs.
4. containment event to TaskEventsTable; optional Slack/GitHub notify.
5. Tests for each trip reason and recovery (operator resume).

Other information

• #390/#428 are adjacent RFCs; this is the productized circuit breaker.

• Design context: docs/design/SECURITY.md, docs/design/REPO_ONBOARDING.md.

• This might be a breaking change

Read ROADMAP.md and the design context in docs/design/SECURITY.md and docs/design/REPO_ONBOARDING.md, then trace the agent hooks, runner, orchestrator containment path, emergency session containment APIs, and TaskEventsTable. Define and test each trip reason, credential revocation and containment event behavior, notification options, and operator resume recovery.