feat(acp): bind the harness to one owner thread

[tee8z]

A remote workspace must act only for its owner, in one thread. The harness can accept prompts from other people, sibling agents, workflows, and other channels. This PR adds a strict owner respond-to mode and an optional bound session that pins the harness to one channel and canonical thread root.

--bound-session refuses to start unless every setting below holds:

Setting	Required value
--respond-to	owner
--subscribe	mentions, without --no-mention-filter
--session-policy	thread
--heartbeat-interval	0
Initial message	None

• owner admits only the human owner's signed events, in DMs and channels. It excludes sibling agents and workflow attribution.
• A bound session drops ingress and control commands from any other channel or thread root.
• The agent-full-access permission mode is for externally isolated containers. The adapter must advertise and confirm it, and it never falls back to per-tool approval.

Stack

Position 3 of 20 in the DEV-2884 Buzz stack. Base: #9. Next: #11.

Validation

Run on this layer's commit, for buzz-backend-kubernetes and buzz-acp:

• cargo fmt --check: pass.
• cargo clippy --all-targets -- -D warnings: pass.
• cargo test -p buzz-backend-kubernetes: 171 passed, 0 failed.
• cargo test -p buzz-acp: 1,083 passed, 3 ignored, 0 failed.

Limits

• Nothing in this layer sets these flags yet; the Sandbox provider in a later layer does.
• Buzz AGENTS.md requires a human to test the change before it leaves draft.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}