agent-context: enforce session-thread namespace and reject explicit title access

[levineam]

Motivation

• Prevent MCP tools and session-thread helpers from exposing or modifying arbitrary vault notes by ignoring caller-supplied title/noteTitle values and enforcing the JarvOS Session Thread - <threadId> namespace.
• Fail closed when a resolved note does not contain session-thread frontmatter to protect confidentiality and integrity of non-session notes.
• Add regression tests to ensure the session-thread read/write surface cannot be redirected to arbitrary notes.

Description

• sessionThreadTitle now always derives the note title from the normalized thread key and ignores input.title/input.noteTitle, removing the explicit-title attack surface in src/index.js.
• Added hasSessionThreadFrontmatter and assertSessionThreadNote and invoked them before reading or modifying existing files in readSessionThread and writeSessionThread to reject non-session-thread files.
• Removed the explicit title property from the jarvos_session_thread_read and jarvos_session_thread_write MCP tool inputSchema in scripts/jarvos-mcp.js so MCP callers cannot pass an explicit filename.
• Added tests in test/agent-context.test.js that verify explicit-title attempts do not expose private note bodies and that namespace collisions without session-thread frontmatter are rejected without modifying the target file.

Testing

• Ran the package test suite with npm test in modules/jarvos-agent-context (which executes node --test test/*.test.js), and all tests passed (55/55).
• The new regression tests covering explicit-title read/write and namespace-collision rejection passed as part of the suite.

---

Codex Task