fix(foundry): support session-bound brokered continuations

[sozercan]

Summary

• accept the Orka continuation proof from either the compatibility header or the top-level request body
• derive the effective hosted Responses session from Foundry's runtime identity before caller-controlled fallbacks
• persist session identity with pending brokered state and reject missing or cross-session continuations
• document the bounded Foundry session-backed file-state deployment and security constraints

Why

Foundry hosted continuations can lose custom request headers, while the public Responses gateway requires agent_session_id in the request body to route a follow-up to the original sandbox. AgentKit previously accepted only the custom proof header and did not consume body session identity before taking the continuation branch.

This could reject a legitimate Orka continuation before state lookup, or route it to state without verifying that the pending response belongs to the effective Foundry session.

Behavior

• matching proof in either carrier is accepted; a wrong carrier does not override a matching one
• malformed, empty, non-string, non-ASCII, and unpaired-surrogate proof candidates fail closed with the normal 403 envelope
• FOUNDRY_AGENT_SESSION_ID takes precedence over body/query/header compatibility values inside the hosted container
• pending state with a stored session ID requires the same effective session on continuation
• proof values are not sent to the model, persisted in response state, or echoed in Responses payloads
• AgentKit does not synthesize or echo agent_session_id; Foundry remains the owner of the public session field

Validation

• uv run --directory runtimes/common --extra dev pytest -q — 303 passed
• go test ./...
• make lint — 0 issues
• go test ./examples/harness/foundry-responses in the coordinated Orka worktree
• structured autoreview — clean, no accepted/actionable findings

Scope

This is a stacked follow-up to #19. Live Foundry gateway passthrough, immediate affinity, and explicit session stop/resume evidence remain deployment validation gates; this PR does not claim multi-replica or production-grade durability.