fix: prevent sub-agents from escalating recursion depth

[Mantissagithub]

Summary

• freeze child depth, maximum depth, and parent session state when the IPython kernel starts
• override mutable recursion context on calls through the injected rlm
• derive X-RLM-Depth from the engine's explicit depth
• clamp recursion to a hard maximum depth of 8
• add API-level and real-IPython regression coverage

Root cause

Recursive engines derived their depth and maximum depth from RLM_DEPTH and RLM_MAX_DEPTH inside the IPython process. A sub-agent could rewrite those variables before calling rlm, causing the next engine to treat it as a root agent with a higher recursion limit. The same mutated depth was also used for the inference request header and child-session placement.

The injected rlm wrapper now captures the recursion context when the kernel is initialized and passes it through private arguments that override caller values. The engine threads that explicit depth into the child REPL and inference client. At the configured limit, rlm remains absent from the preloaded namespace, but an explicit import still receives the bounded wrapper and records a normal depth_limit result.

This is defense in depth for the reported environment-variable bypass. Full isolation from arbitrary in-process Python still requires a separate trusted process or sandbox boundary.

Validation

• uv run pytest tests/ — 116 passed
• uv run pre-commit run --all-files — passed
• git diff --check — passed

Closes #130

[Mantissagithub]

cc @hallerite