feat(security): behavioral circuit breaker with containment

**Context:** ROADMAP.md → Security → Behavioral circuit breaker
**Related:** #390, #428, #251, emergency-session-containment draft

---

## Component

Agent (Python runtime)

## Describe the feature

Per-session limits on:

- **Tool-call rate**
- **Cumulative cost**
- **Consecutive failures**
- **File churn**

On trip: pause or **terminate** session, **revoke short-lived credentials** where applicable, emit **`containment` audit event**. Configurable per repo via Blueprint (`SECURITY.md`, `REPO_ONBOARDING.md`).

**Design principle:** prefer hard containment over friction-only limits (rate/turn caps alone). Pairs with emergency session containment APIs.

## Use case

Runaway agents (infinite tool loops, runaway edits, budget burn) need automated stop—not just logging. Operators want repo-specific thresholds aligned with risk.

## Proposed solution

1. In-agent monitor (hooks + runner) tracking rolling windows.
2. Blueprint thresholds per signal; defaults conservative.
3. On trip: call orchestrator containment path → emergency session containment APIs.
4. `containment` event to `TaskEventsTable`; optional Slack/GitHub notify.
5. Tests for each trip reason and recovery (operator resume).

## Other information

- #390/#428 are adjacent RFCs; this is the **productized circuit breaker**.
- Design context: `docs/design/SECURITY.md`, `docs/design/REPO_ONBOARDING.md`.

- [ ] This might be a breaking change

ROADMAP.md と docs/design/SECURITY.md および docs/design/REPO_ONBOARDING.md の設計コンテキストを読み、続いて agent hooks、runner、orchestrator の containment path、emergency session containment APIs、TaskEventsTable を追跡します。各 trip reason、credential revocation と containment event の動作、通知オプション、および operator による resume のリカバリを定義してテストします。

索引モデルが issue の本文から書いたものです。