feat(ai): session harness contract — incomplete, run_id, confirm bind

Add docs/16 for session state machine, incomplete/resume, queue semantics,
and agent-loop/harness/MCP gap review. Wire RunOutcome on max-rounds,
run_id through audit, TrimMessages/Redact hooks, ConfirmBindHash on write
confirm path; session file skeleton without HTTP yet. No push.

server/internal/server/router.go

@@ -532,6 +532,8 @@ func NewRouter(token string) *gin.Engine {
 				Command      string `json:"command"`
 				Database     string `json:"database"`
 				Kind         string `json:"kind"` // query | redis
+				ConfirmBind  string `json:"confirmBind"`
+				RunID        string `json:"runId"`
 			}
 			if err := c.ShouldBindJSON(&req); err != nil {
 				c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
@@ -546,7 +548,16 @@ func NewRouter(token string) *gin.Engine {
 				c.JSON(http.StatusForbidden, gin.H{"error": "writes disabled: set mode=read_write in ~/.opsxdb/mcp.json"})
 				return
 			}
+			stmt := strings.TrimSpace(req.SQL)
+			if stmt == "" {
+				stmt = strings.TrimSpace(req.Command)
+			}
+			if err := aitools.VerifyConfirmBind(req.ConnectionID, stmt, req.ConfirmBind); err != nil {
+				c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+				return
+			}
 			rt.Source = "agent"
+			rt.RunID = strings.TrimSpace(req.RunID)
 			rt.RejectCallerConfirm = false
 			rt.AllowConfirmedWrite = true
 			kind := strings.ToLower(strings.TrimSpace(req.Kind))