feat(plugin): implement INVOKE_RERANK handler with run-scoped authorization

- Add invoke_rerank action handler in plugin handler
- Validate rerank model access via run session
- Cap documents at 64 for API limit
- Return sorted results by relevance score

tests/unit_tests/agent/test_session_registry.py

@@ -108,6 +108,7 @@ class TestSessionRegistryBasic:
                 'model': set(),
                 'tool': set(),
                 'knowledge_base': set(),
+                'file': set(),
             },
         }
 
@@ -169,6 +170,7 @@ class TestSessionRegistryBasic:
                 'model': set(),
                 'tool': set(),
                 'knowledge_base': set(),
+                'file': set(),
             },
         }
         new_session: AgentRunSession = {
@@ -185,6 +187,7 @@ class TestSessionRegistryBasic:
                 'model': set(),
                 'tool': set(),
                 'knowledge_base': set(),
+                'file': set(),
             },
         }
 
@@ -328,6 +331,36 @@ class TestIsResourceAllowed:
 
         assert registry.is_resource_allowed(session, 'unknown_type', 'something') is False
 
+    def test_file_allowed(self):
+        """File in resources should be allowed."""
+        registry = AgentRunSessionRegistry()
+        resources = make_resources(
+            files=[
+                {'file_id': 'file_001'},
+                {'file_id': 'file_002'},
+            ]
+        )
+        session = make_session(resources=resources)
+
+        assert registry.is_resource_allowed(session, 'file', 'file_001') is True
+        assert registry.is_resource_allowed(session, 'file', 'file_002') is True
+
+    def test_file_not_allowed(self):
+        """File not in resources should be denied."""
+        registry = AgentRunSessionRegistry()
+        resources = make_resources(files=[{'file_id': 'file_001'}])
+        session = make_session(resources=resources)
+
+        assert registry.is_resource_allowed(session, 'file', 'file_999') is False
+
+    def test_file_empty_resources(self):
+        """Empty files list should deny all."""
+        registry = AgentRunSessionRegistry()
+        resources = make_resources(files=[])
+        session = make_session(resources=resources)
+
+        assert registry.is_resource_allowed(session, 'file', 'file_001') is False
+
     def test_missing_resources_field(self):
         """Missing resources field should not raise."""
         registry = AgentRunSessionRegistry()