feat(agent): add canonical session identity contract

[0xSero]

Summary

• add the strict, versioned canonical session identity foundation for Wave 1 Task 05A
• preserve distinct runtime, environment, filesystem, controller, placement, archive, and capability identities
• cover all 14 exported schemas plus collision, canonical ordering, ChatGPT provenance, and strict boundary behavior

Validation

• focused contract tests: 11 passed, 0 failed
• npm run check: passed
• npm run test:integration: 108 passed, 0 failed
• independent code review: PASS
• pre-push hooks: passed

Scope

Exactly two files and one 557-line commit. No manifests, lockfiles, browser, Electron, services, live controllers, or deployment state changed. This targets the campaign integration branch and does not claim consumer, installed-app, or live-runtime acceptance.