Sensitivity is a label that survives delegation

[jhrozek]

A labelled session's children carry the label, and the four labels that exist today stop silently
dropping.

mecatl. After #367.

Hazards

Facts that were expensive to find and that nobody re-derives on the way to implementing. Each is verified against code.

• The label mechanism already exists and already fails open: Profile, ProviderID, ModelID and
  ReasoningEffort propagate on ForkSession and on no other child-mint path, of which there are
  eight in engine/agent.
• A label is mecatl's own vocabulary, not a set of IdP group names. The sibling's normalised
  Groups field is dead — never populated, never read — because group claim names vary by provider.
  Persisting them freezes at create time, so revoking a group leaves old sessions readable.
• The model must not author the rationale a human reads when approving a release. That is
  justification capture, and the repo already solves the shape once in the ask-reviewer discipline.

Acceptance criteria

• Every object-creation path stamps the label. One propagation path, and a test that enumerates all
  of them rather than sampling.
• The durable label is mecatl's own closed vocabulary. Provider claim names appear in exactly one
  config table and nowhere downstream.
• The caller's labels are computed per request and never persisted, so revocation takes effect
  without rewriting stored objects.
• Access is a set-dominance check with no sensitivity ladder and no policy engine.
• The model can neither lower a label nor author the text a human relies on when releasing
  something, and a test proves the instruction saying so reaches the system prompt.

Proof

The same properties, adversarially, with an actor and an ordering. A property-level criterion can go green while being false; these are what stop that.

• A labelled session spawns a subagent, a parallel branch and a team member; each carries the label.
• A caller whose live labels do not dominate the session's is refused.
• Revoking a caller's group takes effect on the next request, with no store rewrite.
• The model attempts to lower a label and to write its own release justification; both refused.

Slices

Decomposition is the implementer's job; these are the natural seams, not a mandate.

• The label itself, propagated at every creation seam.
• The transitions that are not session creation.

Reasoning

The design this comes from, both on main:

• docs/agent-identity-model.md — the inbound side: who is acting, and how mecatl would identify them.
• docs/agent-identity-outbound.md — the outbound boundary: acting for a user against an external system.

Every hazard above is stated in full here rather than linked, so this issue stands on its own.