Resource exhaustion anomaly detection

[byapparov]

Phase 4 — Threat and anomaly signals

Track tool call rate, token consumption rate, and file modification rate per session. Emit warning when rates are anomalous relative to session baseline.