research: add cumulative multi-turn and per-caller risk scoring

Motivation

Single-turn risk labels do not capture accumulation across a session or repeated behavior from a trusted caller identity. This issue is a research/contract task: current main has session telemetry and classification signals, but no production cumulative-risk accumulator.

Audited upstream baseline (2026-07-15)

• pkg/sessiontelemetry holds bounded in-process session aggregates.
• Classification and decision DSL signals can influence a request.
• Router Replay can preserve content-minimized routing and outcome evidence.
• Trusted caller identity and impersonation-resistant extraction are separate prerequisites (#2362).
• pkg/authz resolves upstream credentials; it is not the policy/RBAC state store.
• Router Memory is prompt-visible conversation memory and must not be used as a security reputation database.

Scope

1. Define typed, content-minimized risk observations and their provenance.
2. Define two explicit scopes:
   • session-local accumulation with bounded in-process state;
   • optional caller-level aggregation only after trusted identity and privacy/retention contracts exist.
3. Specify decay, TTL, uncertainty, minimum evidence, conflict resolution, and fail-open/fail-closed behavior by risk class.
4. Feed the derived signal through classification/decision policy; keep hard authorization and safety rules dominant.
5. Persist only privacy-reviewed replay evidence and aggregate state needed for audit.
6. Evaluate false positives, cross-tenant isolation, poisoning, restart, and multi-replica semantics before enforcement.

Non-goals

• No identity inferred from untrusted request text or arbitrary headers.
• No global permanent reputation score.
• No raw-conversation security archive in Router Memory.
• No automatic cross-agent propagation without an explicit trust domain and threat model.

Acceptance criteria

• Threat model and trusted identity dependency are documented.
• Schemas, TTL/decay, cardinality, and retention limits are validated.
• Session-only mode works without durable storage.
• Missing/stale identity cannot merge tenants.
• Every policy effect has a deterministic reason and replay trace.
• Shadow evaluation reports false-positive/false-negative trade-offs before enforcement.
• Tests cover poisoning, concurrency, restart, and safety precedence.

Likely change surfaces

src/semantic-router/pkg/sessiontelemetry/, src/semantic-router/pkg/classification/, src/semantic-router/pkg/extproc/, src/semantic-router/pkg/routerruntime/, src/semantic-router/pkg/routerreplay/, src/semantic-router/pkg/config/, observability, docs, and tests.

Depends on #2362. Related: #2357, #2548.