Migrate session and exec state to host authority #636

Goal

Migrate the remaining session identity and execution state that acq trusts from guest-writable markers to host-authoritative state, following the provider projection pattern already proven by #601.

Scope

• Inventory every remaining guest read of agent, workspace, SSH socket, and kit environment state on SBX and MSB.
• Persist host-authored values in the per-sandbox host config store or inject them directly at exec time.
• Remove guest-marker reads for the migrated fields.
• Preserve current defaults and explicit failure behavior.
• Add focused SBX/MSB tests proving forged guest markers cannot change acq session behavior.

Out Of Scope

• Provider input projection and provider selection, delivered through Adopt provider-neutral OpenCode kits and verify both backends #601.
• Install/readiness/OCI gate migration.
• Trusted restart startup-code staging.
• Full legacy-marker cleanup.

Acceptance Criteria

• acq session attach/exec derives agent, workspace, SSH socket, and kit environment from host authority only.
• A guest-writable legacy marker cannot redirect an attach, workspace, socket, or kit environment value.
• Focused offline SBX/MSB coverage proves the trust boundary.
• Real backend validation is recorded before closing.

Relationship

Child of #503. This work is stacked above draft #611 so it cannot merge before the provider-neutral adoption path.

AI-assisted issue drafting (OpenCode). Human review required.