feat(events): interception seams — the typed-Decision surface for hooks

Reshape the agent's interception surface so every seam returns a small, typed
Decision union, and the set covers the hook points a CC/Codex bridge (and a
native plugin) needs. "Native hooks" are not a package — a native hook is just a
cordis plugin on these canonical events; the bridges (a later PR) only translate
an external protocol onto the same surface.

dsh-agent:
- NEW agent/session-start(agent, source) emit (once before turn 1; SessionStartSource
  startup|resume|clear|compact) — a pure notification, seeds context via inject().
- NEW agent/prompt-submit waterfall → PromptDecision (allow, optionally rewriting the
  prompt or attaching additionalContext, or block).
- RESHAPE agent/turn-continuation boolean → ContinuationDecision ({action:'stop'} |
  {action:'continue', reason?}; a continue reason is recorded as next-step steering).
- New HookContext envelope (required source — inject() would mislabel a missing one).

dsh-tools: split the single tools/execute waterfall into tools/pre-execute
(PreToolDecision allow/deny/ask gate) and tools/post-execute (PostToolDecision
accept/block, optionally replacing content or attaching additionalContext). Core
dispatch sits between as plain code; the tool body keeps its inner try/catch so a
thrown tool still reaches post-execute as an isError. ToolExecutionResult gains
additionalContext (ferried to the loop's per-step buffer). Input rewrite is
deliberately NOT offered (a proposed RFC designs it consistently).

dsh-session: new `rejected` TurnEndReason — a turn whose whole prompt batch was
blocked by prompt-submit.

agent-loop firing points: session-start emitted at create (source threaded —
startup for create/fork, resume for resume()); prompt-submit per drained message
with the always-open-turn rule (a fully-blocked batch is a zero-step rejected
turn); the continuation reshape; post-tool additionalContext buffered and appended
after all tool/results (adjacency). ACP codec maps rejected→cancelled.

A worked native-plugin example (interception.spec.ts) proves all four seams compose
end-to-end through the real loop with NO hook/* events (those belong to the bridge
lib). All existing tools/execute + turn-continuation tests migrated. The
tool-subagent abort test now aborts after a microtask so it still exercises the
live onAbort bridge (execute() awaits pre-execute before the body runs).

RFCs: implemented/feature/2026-06-30-interception-seams.md (the reshape) +
proposed/feature/2026-06-30-pre-tool-input-rewrite.md (the deferred rewrite design).

packages/core/agent-loop/README.md

@@ -45,10 +45,14 @@ Agents listed in config are auto-created at startup.
 One invocation of `runLoop()` drives one agent for its whole lifetime:
 
 ```
+create agent → emit agent/session-start(source)   ⟵ once, before turn 1
 forever:
   wait for queued messages (idle)
   TURN (error-contained):
-    drain queued → 'turn/start' → session('user/message')
+    'turn/start'
+    each queued: waterfall agent/prompt-submit → allow (→ session('user/message'),
+      inject additionalContext) | block (drop)
+    if every prompt blocked: 'turn/end'(rejected), no step  ⟵ zero-step turn
     STEP loop:
       drain steering
       assembly = systemPrompt.assemble()
@@ -56,10 +60,14 @@ forever:
       stream llm.stream(request) → session('assistant/chunk')
       message = waterfall agent/step-result
       session('assistant/message')
-      each tool-call: session('tool/call') → tools.execute() → session('tool/result')
+      each tool-call: session('tool/call')
+        → tools.execute() [waterfall tools/pre-execute → dispatch → tools/post-execute]
+        → session('tool/result')
+      append buffered post-execute additionalContext as session('context/message')(s)
       drain steering → session('steering/message')
-      cont = waterfall agent/turn-continuation
-      if !cont: break
+      cont = waterfall agent/turn-continuation → ContinuationDecision
+        ({action:'continue', reason?} records reason as next-step steering)
+      if action==stop (and no pending steering): break
     session('turn/end')
     await session/flush
     re-enqueue leftover steering as queued
@@ -73,9 +81,9 @@ Cancellation: `agent.cancel()` is the single public stop primitive — it clears
 ### What is NOT here
 
 Everything that goes beyond "call the model, run the tools, repeat" belongs to plugins listening on the event taxonomy:
-- Hooks: `agent/request`, `agent/step-result`, `tools/execute`, `agent/turn-continuation`
+- Hooks: `agent/session-start`, `agent/prompt-submit`, `agent/request`, `agent/step-result`, `tools/pre-execute`, `tools/post-execute`, `agent/turn-continuation`
 - Compaction: `agent/request`
-- Sandbox, permission, plan mode: `tools/execute`
+- Sandbox, permission, plan mode: `tools/pre-execute` (deny/ask gate), `tools/post-execute`
 - Sub-agents: TODO seam on `AgentLoop.create()`
 - Persistence: `session/event` + `session/flush`
 - UI: `agent/stream-chunk` + `agent/*` events