为 AI 代理安全执行 Kryos 代码，完成类型检查、运行与权限能力校验。
Agent context flight recorder: restore after compaction, fan-out packs, signed git-bound receipts.
