Add agent persistent security state gates

[Errordog2]

Summary

• Adds persistent security-state review for high-impact agent workflows.
• Requires durable storage for active constraints, prior denials, risk/budget state, approval scope/expiry, actor chain, and policy version.
• Adds sequence-aware tool-chain evaluation, denial inheritance, rollover/resume tests, policy decision input logging, and output sections for state and sequence review.

Addresses #2556.

Validation

• git diff --check
• Markdown fence balance check
• Targeted marker check for v1.0.3, persistent security state, sequence-aware tool-chain evaluation, denial inheritance, approval binding, rollover/resume tests, and output fields