fix: bind agent sessions to role

docs/adr/0017-agent-session-is-provider-bound.md

@@ -29,11 +29,13 @@ conversion. The SDK's `query()` owns the agent loop (tool dispatch, compaction,
 streaming). Built-in tools (Read, Write, Bash, Glob, Grep) cover the entire
 tool surface — no custom tools needed. `cph check` / `cph build` run via Bash.
 
-The Hub `AgentSession` remains provider/model-bound, but it must persist the
+The Hub `AgentSession` is provider/role/model-bound, and it must persist the
 provider runtime cursor needed to continue a conversation. For Claude Code SDK,
 that cursor is the `result.session_id`; store it in `AgentSession.metadata` as
 `claudeSessionId` and pass it back to the next `query()` call as
-`options.resume`.
+`options.resume`. Role is part of the session binding because role prompts and
+tool surfaces can differ even when the underlying model is the same; `/draft`
+and `/review` must not resume the same Claude runtime cursor by accident.
 
 Environment variables:
 ```
@@ -43,14 +45,16 @@ ANTHROPIC_API_KEY=""  # must be explicitly empty
 ```
 
 Model routing: `ANTHROPIC_DEFAULT_SONNET_MODEL` etc. accept OpenRouter model
-IDs (e.g. `z-ai/glm-4.7`, `anthropic/claude-sonnet-4-20250514`). This means
-**provider-agnosticism is preserved** — any OpenRouter model that supports tool
-use can be used, not just Anthropic models.
+IDs (e.g. `z-ai/glm-4.7`, `anthropic/claude-sonnet-4-20250514`). This gives
+limited OpenRouter-level model routing, but the runtime is still Claude Agent
+SDK-shaped: non-Claude models are best-effort and may not support every
+Claude Code feature.
 
 ## Consequences
 
-- Provider-agnosticism preserved via OpenRouter — GLM, Claude, GPT, etc. all
-  work as long as the model supports tool use.
+- Provider-agnosticism is not fully preserved. OpenRouter can route to GLM,
+  Claude, GPT, etc., but the runtime protocol and agent loop remain Claude
+  Agent SDK-bound.
 - The agent loop is Claude Code SDK's (compaction, tool approval, partial
   message streaming) — not hand-rolled.
 - Custom tools (read_file, write_file, cph_check, cph_build) are replaced by