feat: harden served-agent safety controls

[aheritier]

Summary

Harden served-agent safety controls across A2A, MCP HTTP, and chat surfaces. The change applies restricted safety defaults, isolates session origins, gates unsafe bindings, and keeps startup behavior explicit for autonomous configurations.

Commit-by-commit review guide

• da7844c0 — establish served-agent safety policy foundations.
• f6b85569 — add session-origin isolation and persistence safeguards.
• dd5abea7 — add per-surface bind and transport controls.
• 6d5d317e — cover safety behavior with focused tests.
• 9df38cd0 — document configuration and operational behavior.
• 64d543c8 — add endpoint collision coverage.
• 008fb5ac — refine policy handling and compatibility paths.
• 6af32590 — add autonomous startup validation.
• 11d5f983 — align migration and rollback guidance.
• db377acb — clarify troubleshooting and feature documentation.
• 1c58df4a — correct flag and behavior documentation.
• 0413770f — complete final review-driven hardening and test coverage.

Validation

• task build — green
• task test — green
• task lint — green

Review verdicts

• Local implementation review: approved.
• Focused delta review: approved.

Migration and compatibility

• New served-agent safety defaults are restricted by design; deployments that rely on broader access should explicitly configure the required allowances.
• Existing sessions retain their established behavior while new origin mismatches are rejected and session origin state is not silently replaced.
• Startup validation makes autonomous configurations fail clearly when required safety settings are missing or incompatible.