feat(ai): session harness contract — incomplete, run_id, confirm bind

Add docs/16 for session state machine, incomplete/resume, queue semantics,
and agent-loop/harness/MCP gap review. Wire RunOutcome on max-rounds,
run_id through audit, TrimMessages/Redact hooks, ConfirmBindHash on write
confirm path; session file skeleton without HTTP yet. No push.

server/internal/aitools/runtime.go

@@ -53,6 +53,8 @@ type Runtime struct {
 	AllowConfirmedWrite bool
 	// Source 写入审计：mcp | agent。
 	Source string
+	// RunID 写入审计，串联一次 Agent run。
+	RunID string
 }
 
 func NewRuntime(policy Policy) *Runtime {
@@ -77,6 +79,9 @@ func (r *Runtime) audit(e AuditEntry) {
 	if e.Source == "" {
 		e.Source = r.Source
 	}
+	if e.RunID == "" && r.RunID != "" {
+		e.RunID = r.RunID
+	}
 	if r.Audit != nil {
 		r.Audit(e)
 		return
@@ -399,11 +404,13 @@ func (r *Runtime) executeQuery(ctx context.Context, args map[string]any) (any, e
 		// P1：可写已开启，但无确认令牌则返回 needConfirm（永不静默写）。
 		if !confirmed {
 			r.audit(AuditEntry{Tool: ToolExecuteQuery, ConnectionID: id, OK: false, Error: "needConfirm", Summary: truncate(sqlText, 80)})
+			bind := ConfirmBindHash(id, sqlText)
 			return map[string]any{
-				"needConfirm": true,
-				"sql":         sqlText,
-				"message":     "write requires explicit user confirmation",
-				"reason":      readReason,
+				"needConfirm":  true,
+				"sql":          sqlText,
+				"confirmBind":  bind,
+				"message":      "write requires explicit user confirmation",
+				"reason":       readReason,
 			}, nil
 		}
 	}
@@ -471,11 +478,13 @@ func (r *Runtime) executeRedis(ctx context.Context, args map[string]any) (any, e
 		}
 		if !confirmed {
 			r.audit(AuditEntry{Tool: ToolExecuteRedisCommand, ConnectionID: id, OK: false, Error: "needConfirm", Summary: truncate(command, 80)})
+			bind := ConfirmBindHash(id, command)
 			return map[string]any{
-				"needConfirm": true,
-				"command":     command,
-				"message":     "redis write requires explicit user confirmation",
-				"reason":      rerr.Error(),
+				"needConfirm":  true,
+				"command":      command,
+				"confirmBind":  bind,
+				"message":      "redis write requires explicit user confirmation",
+				"reason":       rerr.Error(),
 			}, nil
 		}
 	}