Work can be shared deliberately

[jhrozek]

Alice adds Bob as an observer, then hands off.

mecatl. Needs #368 and #369 both — this is the last one.

Hazards

Facts that were expensive to find and that nobody re-derives on the way to implementing. Each is verified against code.
Per-item read control inside a session is defeated three ways, each silently: the
model can include the content in an answer, the agent re-derives it under a new prompter
unlabelled, and compaction folds the label away. The primitive for mixed sensitivity is a
separate derived artifact — a fork — which is the tearline pattern every document vendor
converged on independently.

Acceptance criteria

• Sharing is an explicit recorded act with a named author. Access is never inferred from activity.
• Read and prompt are separate grants, so an observer is a first-class state rather than a weakened
  owner.
• Only a principal who already holds the object can extend access to it.
• Mixed sensitivity is handled by deriving a new object, and the doc says why per-item fields are
  not offered.

Proof

The same properties, adversarially, with an actor and an ordering. A property-level criterion can go green while being false; these are what stop that.

• Alice adds Bob as an observer: he reads, and cannot prompt.
• Alice hands off: Bob prompts, and Alice's own access follows the recorded decision rather than
  silently vanishing.
• Bob cannot add himself, and cannot add a third party.

Slices

Decomposition is the implementer's job; these are the natural seams, not a mandate.

• Read-only observers first, then explicit handoff.

Reasoning

The design this comes from, both on main:

• docs/agent-identity-model.md — the inbound side: who is acting, and how mecatl would identify them.
• docs/agent-identity-outbound.md — the outbound boundary: acting for a user against an external system.

Every hazard above is stated in full here rather than linked, so this issue stands on its own.