Build shared matter state and attack it

The service, not the agent, decides what becomes state. The agent's identity and its trust tier are fixed by the harness from what the agent is reading, so an agent that reads a seller's reply writes as third_party_document whatever the reply says. Each write then goes through four checks, each of which can stop an attack alone: field authority, trust tier, the Pydantic schema (with extra="forbid", so there's no field that could hold bank details), and compare-and-set. Payment details are kept out of memory altogether, and the client assistant gets a working memory that leaves out anything derived from third-party documents. The attack run shows which layer stopped each attempt.