feat(security): behavioral circuit breaker with containment

**Context:** ROADMAP.md → Security → Behavioral circuit breaker
**Related:** #390, #428, #251, emergency-session-containment draft

---

## Component

Agent (Python runtime)

## Describe the feature

Per-session limits on:

- **Tool-call rate**
- **Cumulative cost**
- **Consecutive failures**
- **File churn**

On trip: pause or **terminate** session, **revoke short-lived credentials** where applicable, emit **`containment` audit event**. Configurable per repo via Blueprint (`SECURITY.md`, `REPO_ONBOARDING.md`).

**Design principle:** prefer hard containment over friction-only limits (rate/turn caps alone). Pairs with emergency session containment APIs.

## Use case

Runaway agents (infinite tool loops, runaway edits, budget burn) need automated stop—not just logging. Operators want repo-specific thresholds aligned with risk.

## Proposed solution

1. In-agent monitor (hooks + runner) tracking rolling windows.
2. Blueprint thresholds per signal; defaults conservative.
3. On trip: call orchestrator containment path → emergency session containment APIs.
4. `containment` event to `TaskEventsTable`; optional Slack/GitHub notify.
5. Tests for each trip reason and recovery (operator resume).

## Other information

- #390/#428 are adjacent RFCs; this is the **productized circuit breaker**.
- Design context: `docs/design/SECURITY.md`, `docs/design/REPO_ONBOARDING.md`.

- [ ] This might be a breaking change

Lisez ROADMAP.md ainsi que le contexte de conception dans docs/design/SECURITY.md et docs/design/REPO_ONBOARDING.md, puis suivez les hooks de l’agent, le runner, le chemin de confinement de l’orchestrateur, les APIs de confinement des sessions d’urgence et TaskEventsTable. Définissez et testez chaque motif de déclenchement, le comportement de révocation des identifiants et des événements de confinement, les options de notification ainsi que la récupération lors de la reprise par l’opérateur.

Rédigé par le modèle d'indexation à partir du texte de l'issue.