Observe sessions

Observe ingests AgentEvent-compatible sessions into /app/kya/sessions.

• Tag sessions with host=ide or host=runtime.
• Risk levels: LOW / MEDIUM / HIGH.
• High risk raises policy tier. It does not approve side effects.
• Clearance is separate: Read, Build, or Deploy. HIGH risk follows the workspace shrink mode.
• Session detail shows tools when the payload includes them. A signed session claim is available on the plane.

Enable via kya.adr-sensor-ingest flags. Developers: see session ingest API.