fix: protect foreign session permissions

[leoncheng57]

Summary

• establish a session's upstream agent identity from session metadata and persisted messages before activating Plan/Build policy
• reject foreign or unknown agents with actionable typed 409 errors before PATCH or prompt delivery
• keep Plan/Build recovery and idempotent permission suffix behavior while showing unsupported sessions honestly in the client

Verification

• npx vitest run tests/agent-mode.test.ts tests/session-mode-policy.test.ts
• npm run test:e2e -- --grep "foreign agent|unknown agent identity|recovers Build|fails closed when Plan|supports Build to Plan"
• npm run typecheck
• npm test
• npm run build
• git diff --check