Expose identity-bound awaited host admission for native Remote input

## Feature request

Please expose and document a supported host admission contract for native Remote-origin input that combines runtime-attested input identity with an awaited allow/deny/hold decision before the relevant history persistence, model dispatch and effects.

This is a public API-contract request, **not a newly reproduced runtime failure or a claim that current hooks provide this guarantee**. It is also separate from owner-connection/RPC transport failures.

## Public versions and evidence

- Released SDK: [v1.0.13](https://github.com/github/copilot-sdk/releases/tag/v1.0.13), commit `f13e4a2cc7e4e220974d2333142234e162a3252e`.
- Public main examined: `f45c46fd1812f8bed5b4cbc250f47177c83068f0`; [comparison from the release](https://github.com/github/copilot-sdk/compare/f13e4a2cc7e4e220974d2333142234e162a3252e...f45c46fd1812f8bed5b4cbc250f47177c83068f0).
- [Submitted-hook documentation at that revision](https://github.com/github/copilot-sdk/blob/f45c46fd1812f8bed5b4cbc250f47177c83068f0/docs/hooks/user-prompt-submitted.md) does not provide the required explicit rejection contract.
- [Experimental authorization events](https://github.com/github/copilot-sdk/blob/f45c46fd1812f8bed5b4cbc250f47177c83068f0/nodejs/src/generated/session-events.ts#L9485-L9689) describe message/effect authority and replay after a turn is read. They are not a documented identity-bound pre-input barrier.

Caller-supplied `MessageOptions.source`, turn indexes, timestamps, text-derived IDs, mutation-only hooks and unawaited event observers do not establish the requested combination. Throwing from a callback is not a substitute for documented fail-closed semantics.

## Minimal contract demonstration

Using the published hook types, dispatch semantics and submitted-hook documentation above, a host cannot express a supported identity-bound rejection that is guaranteed to run before both history/model admission and effects for a native Remote-origin message. Later authorization records necessarily reference an already-read message. No live accounts, private prompts or runtime traces are needed to demonstrate this interface gap.

If a supported API already provides this, please identify its exact version, schema, ordering guarantees and Remote-origin example.

## Requested acceptance criteria

1. Runtime-attested principal/origin, source session and generation, plus stable original root message/event and causal identities that remain consistent across reconnect. Caller-provided provenance labels must not be treated as authentication.
2. An explicitly awaited host decision before the documented persistence/model/effect boundaries, including auxiliary model activity. Please identify whether the guarantee covers remote/cloud persistence, local persistence, or only source-side dispatch. A source callback must not imply that GitHub has not already received the input.
3. Explicit denial, malformed responses, timeout, exception, missing owner and disconnect produce typed non-success and prevent the covered downstream actions. No swallowed-exception or unawaited-observer success path.
4. Real native Remote positive and negative/spoofed/replayed cases use the same admission path. Reconnect preserves decisions and identities without duplicate model/tool/history effects; distinct equal-text turns remain distinct.
5. Publish supported CLI/SDK version pins, ordering tests and an example retaining ordinary allowed custom-tool/permission handling after admission.

## Important separation

Awaited custom-tool and permission handlers are useful for controlling effects after input. This request is for the earlier admission boundary; it does not propose weakening existing permission checks. Likewise, fixing a transport problem, selecting a different model or enabling BYOK is not by itself evidence about cloud intake, account visibility or data retention.

先比较 released 和 public-main 修订版，然后阅读所引用小节附近的 docs/hooks/user-prompt-submitted.md 和 nodejs/src/generated/session-events.ts。在提出更改之前，跟踪文档中记载的 hook 和 authorization 入口点。支持的 contract、顺序、失败行为、identity continuity、版本固定以及原生 Remote 测试都已记录并验证后，才算完成。

由索引模型根据 Issue 内容生成。