sec-default: the rows a conversation keeps continue past the user tier - #97334

Merge order: after the engine has session.append on main AND no live engine release branch lacks it (the engine's build links this mod; the name does not scan on an engine without the event).

The test check is red by construction until a released CLI carries the event, not by accident. This repository's CI installs the released CLI from npm and runs each mod's suite with it; on a CLI without session.append the scan refuses this mod's hooks module ("session.append" is not an event), so sec-default's suite fails there while agents-md, diff and telemetry pass. It turns green on its own with the first release that carries the event, and this merges only after that release is the one CI installs, so that main's CI never goes red for the pull requests that follow.

sec-default: session.append, the event raised once for each row a conversation keeps (a prompt, a tool result, a settings hook's context, a reminder) whose hooks may rewrite what is stored and sent from then on, joins the rows that continue past the user tier (next.to(e, "append")), beside prompt.section and prompt.context. Where an organization seats sec-default, the rows are kept as the organization's tiers and the built-ins left them; everywhere else a person's plugin hooks the event like any other.

• mods/sec-default/hooks/register.ts: one line, the mirror of the prompt.section one.
• mods/sec-default/tests/register.test.ts: one case beside the prompt.section one. A plugin the person installed rewords a settings hook's context row; it is passed over, and the organization's append-tier plugin and what is beneath it stand.
• mods/sec-default/README.md: a row for the event, the list of hooked events names it, and the rows that pass say session.* other than session.append.
• mods/types/claude-code.d.ts: the declarations carry session.append (its input, message, door, origin and result types, the content block type they use, and $.session.append on the test kit's engine).

Checked:

• tsc -p mods/tsconfig.json is clean against the declarations in this branch.
• The new case has not been run yet: no CLI that carries the event was at hand here. It is written as the mirror of the prompt.section case and is to be run, with and without the new line, on the first build that carries the event before this merges.
• On a CLI without the event this mod does not load at all: the scan of a hooks module refuses a name under an engine noun that is not one of the engine's events, and the name has to be a string literal. That is the reason for the merge order above; nothing fires early and nothing can be feature-tested from inside the module.