feat(security): behavioral circuit breaker with containment

**Context:** ROADMAP.md → Security → Behavioral circuit breaker
**Related:** #390, #428, #251, emergency-session-containment draft

---

## Component

Agent (Python runtime)

## Describe the feature

Per-session limits on:

- **Tool-call rate**
- **Cumulative cost**
- **Consecutive failures**
- **File churn**

On trip: pause or **terminate** session, **revoke short-lived credentials** where applicable, emit **`containment` audit event**. Configurable per repo via Blueprint (`SECURITY.md`, `REPO_ONBOARDING.md`).

**Design principle:** prefer hard containment over friction-only limits (rate/turn caps alone). Pairs with emergency session containment APIs.

## Use case

Runaway agents (infinite tool loops, runaway edits, budget burn) need automated stop—not just logging. Operators want repo-specific thresholds aligned with risk.

## Proposed solution

1. In-agent monitor (hooks + runner) tracking rolling windows.
2. Blueprint thresholds per signal; defaults conservative.
3. On trip: call orchestrator containment path → emergency session containment APIs.
4. `containment` event to `TaskEventsTable`; optional Slack/GitHub notify.
5. Tests for each trip reason and recovery (operator resume).

## Other information

- #390/#428 are adjacent RFCs; this is the **productized circuit breaker**.
- Design context: `docs/design/SECURITY.md`, `docs/design/REPO_ONBOARDING.md`.

- [ ] This might be a breaking change

Lee ROADMAP.md y el contexto de diseño en docs/design/SECURITY.md y docs/design/REPO_ONBOARDING.md; después, sigue los hooks del agente, el runner, la ruta de contención del orquestador, las APIs de contención de sesiones de emergencia y TaskEventsTable. Define y prueba cada motivo de activación, el comportamiento de revocación de credenciales y de los eventos de contención, las opciones de notificación y la recuperación al reanudar por parte del operador.

Escrito por el modelo de indexación a partir del texto del issue.