plan(agent): define trusted bridge lifecycle contracts

Document host-owned policy admission, opaque handle lifecycle,
canonical bridge envelopes, Stage B snapshot evidence, split Stage C
gates, and the Task 8 Codex metadata decision gate.

Author: fffonion