feat(tools): session ownership model for destructive operations

[Audacity88]

Problem

Session keys are not scoped per-agent. Any agent with registered SessionResetTool or SessionDeleteTool can reset or delete sessions belonging to other agents or users.

Current Mitigation

• Tools not registered in the default tool set (all_tools_with_runtime) — callers must explicitly opt in
• Both tools enforce SecurityPolicy::enforce_tool_operation(ToolOperation::Act, ...) before executing

What's Needed

A scoping mechanism so destructive session operations are limited to sessions owned by the requesting agent. Possible approaches:

• Session keys include an agent/owner prefix
• A session ACL checked at tool execution time
• SecurityPolicy extended with per-session ownership checks

Context

• Related: feat(tools): add SessionResetTool and SessionDeleteTool for session management #5696 (SessionResetTool and SessionDeleteTool)
• The current mitigation is acceptable short-term but insufficient for multi-tenant or multi-agent deployments that register these tools

[theonlyhennygod]

Triage Summary

Type: Enhancement
Priority: High
Area: security, tool
Risk: High — touches security policy and tool execution boundaries

Summary: Session keys are not scoped per-agent. Any agent with registered SessionResetTool or SessionDeleteTool can reset or delete sessions belonging to other agents or users. Current mitigation is that these tools are not in the default tool set and require SecurityPolicy enforcement, but this is insufficient for multi-tenant or multi-agent deployments.

Duplicates/Related: #5696 (SessionResetTool and SessionDeleteTool)

Actionability: Ready for design. Three approaches are proposed: session key prefixing with agent/owner, a session ACL, or extending SecurityPolicy with per-session ownership checks. Needs architectural decision before implementation.

Notes: The current mitigation (tools not registered by default + SecurityPolicy enforcement) is acceptable short-term. This becomes critical if ZeroClaw targets multi-tenant deployments. Part of the #5833-5837 work package from @Audacity88.