A link's T3-Mode-Limit caps the modes of what it starts, but within those
modes it could still steer the user's own threads or change this
environment's projects and settings. Work a link starts is now fenced to
that link.

The linking side registers its OAuth client with the t3code-peer-link
software id; the receiving side signs that into the session's claims. Every
thread such a session launches carries an immutable linkOrigin, and so do
the subagents, forks and create_threads it derives. A client's own
thread.create cannot set one.

In the shared access declarations, a linked caller may change only threads
of the same link, and may not use writesEnvironment tools (projects,
settings), schedule tasks, or change scheduled tasks. Reads are not fenced.
Setup scripts are skipped for stamped threads in ProjectSetupScriptRunner,
which every path that runs them goes through.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>