Security and compliance: attributable writes, OIDC trust

Goal: every console write can be traced to its browser and agentic session, a widened CI trust is detected rather than silently archived, and the compliance docs describe what the system really does. 1. Console write attribution: Task 7775 had to reconstruct who pressed Run from ALB logs. On every mutating request's activity row (start/stop/reset/delete/settings), record the user agent, the ALB client address (as `login_funnel.client_headers` does for refused sign-ins) and a stable, non-secret console-session id (e.g. a hash of the session cookie's `iat` + identity). Let a runner's browser declare its owning agentic session (e.g. an `X-Jaah-Session` header sent by `tools/console_cdp.cjs`/Playwright). Audit can filter one console session's writes. 2. GitHub OIDC trust: the `github-oidc-pinned-roles` archive rule (`infra/jaah/terraform/org/modules/access-analyzer-archive`, risk R-SOC-49) keeps findings archived even if a role's `token.actions.githubusercontent.com:sub` is loosened outside code. Add a detective control in terraform (an EventBridge rule on `iam:UpdateAssumeRolePolicy` for those roles paging the security topic, or a Config rule failing on a wildcard or foreign `sub`) and name it in R-SOC-49's residual. 3. RoPA/DPA under `docs/compliance/` state that session-efficiency statistics are computed in the control-plane region (Athena reads regional transcripts cross-region since Task 7777). Out of scope: lockout policy; who may press Run; the archive rules themselves; the CI roles' trust policies in code. Done means: - An api test presses Start with a User-Agent and the session header; the `task:run` activity row carries all three facts. - The OIDC control fires on a test `UpdateAssumeRolePolicy` in dev (or Config reports NON_COMPLIANT on a widened trust); R-SOC-49 names it. - The doc change passes `tools/check_context.py`. Required checks: ./dc check full Consolidates drafts 7811, 7829, 7819 (item 4).

Console writes now name browser, ALB address, console and agent session (#6214). Follow-up #6226 keeps staff facts off tenant rows and fixes develop's fixture/Vale breaks. Full gate green. The CI-trust rule fired in dev (MatchedEvents=1). Draft #7916 has the low review items.