feat(invariants): dev-mode event-contract assertions + session-log freeze (RFC 005 pt 3, RFC 008)

New @deepseek-ai/dsh-invariants plugin (pure listeners, off in prod) asserts
the event taxonomy at runtime — seq monotonicity, turn/step nesting, a
tool/result needs a prior tool/call (NOT the converse), legal agent/status
transitions — and deep-freezes logged event data so mutating history throws.
Seeded sessions are checked + frozen on session/created.

The real RFC 008 fix is always-on: deriveMessages now structured-clones the
content it emits, so the loop's sanctioned request/adapter mutation can no
longer reach back and rewrite the append-only log. The pervasive
DeepReadonly<T> type flip is rejected (compile-only, high-noise, castable) —
recorded in ADR 0012, which folds in RFC 008. Wired into both demos.

packages/session/tests/session.spec.ts

@@ -54,6 +54,31 @@ describe('Session', () => {
     expect(replayed.deriveMessages()).toEqual(original.deriveMessages())
     expect(replayed.seq).toBe(original.seq)
   })
+
+  it('isolates the log from mutation through a derived message (append-only contract)', () => {
+    const session = new Session(SessionId('s4'))
+    session.append('user/message', { content: [{ type: 'text', text: 'original' }], source: { kind: 'user' } })
+    session.append('tool/result', {
+      turn: 1, step: 1, callId: CallId('c1'),
+      content: [{ type: 'text', text: 'tool out' }], isError: false,
+    })
+    const before = structuredClone(session.events)
+
+    // A request middleware / adapter mutates the messages it was handed.
+    const messages = session.deriveMessages()
+    const userBlock = messages[0]!.content[0]!
+    if (userBlock.type === 'text') userBlock.text = 'HACKED'
+    const toolBlock = messages[1]!.content[0]!
+    if (toolBlock.type === 'tool-result') {
+      toolBlock.content.push({ type: 'text', text: 'injected' })
+    }
+    messages[0]!.content.push({ type: 'text', text: 'extra' })
+
+    // The log is unchanged: deep-equal to the snapshot taken before mutation.
+    expect(session.events).toEqual(before)
+    // And a fresh derivation still reflects the original content.
+    expect(session.deriveMessages()[0]!.content).toEqual([{ type: 'text', text: 'original' }])
+  })
 })
 
 describe('SessionStore', () => {