[deferred] Risk Evidence Hook

## Scope
- risk_session_id field
- risk_provider field
- 5+ tests

## Deferred from
v0.9.19 → v0.9.20 → v0.9.21

## Target
v0.9.21

## Rationale
Lower priority, x402-secure integration needs careful design.

See: docs/roadmap/DEFERRED.md