feat(security): emergency session containment runbook and APIs

**Context:** ROADMAP.md → Credentials and authorization → Emergency session containment
**Related:** #209 (per-session IAM), #249 (credentials), behavioral circuit breaker draft

---

## Component

API or orchestration

## Describe the feature

Documented operator runbook and platform APIs to contain an active or compromised agent session: cancel the task, terminate the compute session, and revoke short-lived credentials (assumed SessionRole, GitHub App token, Token Vault grants where applicable). Emit a `containment` audit event for incident response.

## Use case

When an operator detects exfiltration, policy bypass attempts, or a tripped circuit breaker, they need a single coordinated containment action—not separate manual steps across Lambda, AgentCore, IAM, and GitHub. Incident response requires predictable, auditable kill switches.

## Proposed solution

1. `POST /tasks/{id}/contain` (operator-only) orchestrating: task cancel → compute termination → credential revocation best-effort.
2. Pair with runbook in `docs/guides/` covering AWS console fallbacks.
3. Wire `containment` event to `TaskEventsTable` and optional SNS/EventBridge (see lifecycle events draft).
4. Integration tests for happy path and partial-failure (e.g. compute already terminal).
5. CLI: `bgagent contain [--reason "..."]`.

## Other information

- Pairs with **Behavioral circuit breaker** (automated containment) and **Per-repo GitHub credentials** (#50, #249).
- Distinct from stranded-task reconciler (scheduled cleanup vs operator-initiated emergency).
- Design context: `docs/design/SECURITY.md`, `docs/design/ORCHESTRATOR.md`.

- [ ] This might be a breaking change

Inizia dalla sezione «Credentials and authorization» di ROADMAP.md, poi leggi docs/design/SECURITY.md e docs/design/ORCHESTRATOR.md; l’issue non identifica file di implementazione o test esistenti. Il lavoro è completato quando l’API e la CLI di containment coordinano la cancellazione, la terminazione del compute, la revoca best-effort delle credenziali e gli eventi di audit, e il runbook in docs/guides e i test di integrazione per il happy path e i fallimenti parziali coprono questo comportamento.

Scritto dal modello di indicizzazione a partire dal testo della issue.