feat(agents): require user consent before cross-orchestrator communication

[decode2]

Before submitting

• I searched open and closed issues and did not find a request for this feature.
• I reviewed this request and removed credentials, tokens, private paths, hostnames, and other sensitive data.

Problem or opportunity

An orchestrator can currently use orchestrator_send_message to send to another session without asking its user for permission. Recipient selection (when multiple peers exist) is not consent to contact them. Cross-orchestrator communication could disclose task context or interrupt another user's session without the initiating user's knowledge.

Proposed outcome

Require an explicit human decision before any outbound orchestrator-to-orchestrator message or equivalent communication. Show the proposed recipient(s), the message or an accurate preview, and a concrete reason why the communication is needed. Offer exactly three decisions:

1. Allow once: authorize only the proposed communication; do not silently extend it to later messages or other recipients.
2. Allow for this session: authorize communication with the selected recipient(s) for the lifetime of the initiating session, not across reloads/restarts or unrelated sessions; a changed recipient set requires a new decision.
3. Deny: send nothing and continue without assuming consent. If interactive consent is unavailable, fail closed without sending.

The permission decision must be enforced at the host/tool boundary for explicit recipient IDs as well as automatic or UI recipient selection; model prose must not grant or widen permission. A recipient picker remains distinct from consent. Tests should cover each decision, subsequent sends, changed recipients, unavailable UI, and session expiry.

Alternatives considered

A prompt-only instruction to ask first is insufficient because direct tool calls can bypass it. Treating recipient selection as authorization does not cover explicit recipient IDs or explain why a message is needed.

Additional context

Related but distinct: #1308 covers recipient selection; #793 and #798 established session messaging and notifications. This request adds sender-side user authorization before communication, not a replacement for recipient selection.