Move session agent toward scoped operation capabilities

Follow-up from #96.

The current session agent returns raw cached lockbox content keys to same-user client processes. That is acceptable for the current local session-cache model, but it does not protect against a malicious process already running as the same user.

Goal:

• Reduce or eliminate raw key return over the agent protocol.
• Move toward scoped, agent-mediated capabilities where clients ask the agent to perform limited operations or receive narrowly scoped authorizations instead of receiving the content key itself.

Initial design questions:

• What operations should be mediated by the agent: open-only, read/list, write, vault key access, or all secret-dependent operations?
• How should capabilities be scoped: lockbox id, path, operation kind, TTL, caller process, interactive approval, or a combination?
• Can we keep CLI ergonomics without making the agent a large privileged filesystem worker?
• What is the migration path from the current GET/PUT key cache protocol?

Acceptance criteria:

• Document the threat model difference between same-user cache and scoped capabilities.
• Propose a protocol shape that avoids handing raw content keys to ordinary clients.
• Identify a minimal first implementation slice and tests for Unix/macOS and Windows transports.

Related:

• #96

Start by reading the follow-up in #96 and tracing the current GET/PUT key-cache protocol. Compare the Unix/macOS and Windows transports, then define the threat model, scoped capability protocol, minimal implementation slice, and corresponding transport tests. Done means raw content keys are avoided for ordinary clients and the migration path is documented.