[Feature]: expose session-scoped state and staged evaluation in OpenCode

## Package

Other — `agent-governance-opencode`

## Problem Statement

The Python surfaces document staged `pre_tool`/`post_tool` evaluation and monotonic session attributes, but the OpenCode integration has no equivalent stateful policy surface. Rules such as “after this session reads personal data, deny outbound tools” cannot be expressed in the OpenCode policy.

Each individual action may be allowed while the sequence is harmful, so stateless per-tool evaluation misses realistic data-flow attacks.

## Impact

We implemented monotonic session ratchets outside the library. They prevent exfiltration sequences, but the committed AGT policy no longer describes the complete policy and the state transitions are not part of AGT's audit/evidence model.

## Proposed Solution

- Expose session-scoped, monotonic attributes in the OpenCode evaluator surface.
- Support reduced staged evaluation around tool execution.
- Define lifecycle, memory bounds, session cleanup, concurrency semantics, and audit events for state changes.
- Provide a reference policy for “sensitive read followed by outbound action”.
- Prevent policy-controlled state from being reset or downgraded by untrusted tool content.

## Alternatives Considered

- Keep session ratchets in an integration wrapper. This is functional but fragments policy and evidence.

## Priority

Important

## Contribution

- [ ] I would be willing to submit a PR for this feature

## Coordination status

No implementation PR is currently linked (checked 2026-08-11). The focused fixes in #3679 and #3677 address denial visibility and prompt-defence reporting respectively; neither implements this session-scoped state model. Related audit enrichment is tracked in #3668.

Contributors are welcome to propose an implementation. Please comment here before starting, search open PRs for overlapping work, and include `Closes #3669` in the PR description.

No implementation files or tests are named. Start by comparing the documented Python pre_tool/post_tool evaluation and monotonic session attributes with the OpenCode evaluator surface; define lifecycle, bounds, cleanup, concurrency, audit events, and protection from untrusted resets. Done means the OpenCode surface and reference sensitive-read-then-outbound policy cover these requirements.

Written by the indexing model from the issue text.