chore: merge origin/main — reconcile divergent branches

Integrates remote changes (session protocol, .custodian-brief.md, MCP
SSE/HTTP mode, workplan OPS-WP-0002 completion) with local changes
(AccessManagementDirective alignment, architecture docs, BRIDGE-WP-0004
and WARDEN-WP-0001 workplans).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.claude/rules/session-protocol.md

@@ -4,7 +4,21 @@ State Hub: http://127.0.0.1:8000
 
 ### Session Protocol
 
+**Step 0 — Tunnel health**
+
+Before anything else:
+```bash
+bridge status
+```
+Bring up any stopped or stale tunnels before accessing remote services.
+
 **Step 1 — Orient**
+
+Read the offline-safe brief first:
+```bash
+cat .custodian-brief.md
+```
+Then call the MCP tool for richer context (skip if unreachable):
 ```
 get_domain_summary("custodian")
 ```