DL-594

Agents hold no Saiph token: the vcs_* tools on a Saiph workspace go through the Runner’s relay to saiphd, which adds the session’s token; each repo’s backend is derived from repoCutoverState and never stored; the git backend is unchanged.

Status: Active (design, 2026-10-19)