feat(tools): adversarial policy agent — pre-execution LLM validation of tool calls

[bug-ops]

Summary

Implements the adversarial policy agent (#2447): before each tool call is dispatched, an independent LLM instance validates the call against user-defined plain-language policies. The validator runs in a separate context with no access to main conversation history.

• New AdversarialPolicyGateExecutor<T> in zeph-tools, gated on policy-enforcer feature
• New PolicyValidator with PolicyLlmClient trait and AdversarialPolicyLlmAdapter bridge in runner.rs
• Fail-closed by default (fail_open = false): LLM errors → deny
• Strict response parsing: only case-insensitive ALLOW/DENY accepted; anything else → deny
• Tool params wrapped in triple-backtick code fence to prevent prompt injection (CRIT-11)
• Full ToolExecutor trait delegation (CRIT-06)
• Policy file loading with canonicalize + config-directory boundary check (SEC-01)
• Executor chain order: PolicyGateExecutor → AdversarialPolicyGateExecutor → TrustGateExecutor
• adversarial_policy_decision field added to AuditEntry (additive, optional)
• Default timeout 3000ms (PERF-01)
• 79 new tests (7269 → 7348)

Config

[tools.adversarial_policy]
enabled = false
policy_provider = "fast"   # named provider from [[llm.providers]]
policy_file = "policies.txt"
fail_open = false
timeout_ms = 3000

Test plan

• cargo +nightly fmt --check — clean
• cargo clippy --all-targets --features full --workspace -- -D warnings — clean
• cargo nextest run --config-file .github/nextest.toml --workspace --features full --lib --bins — 7348/7348 pass
• Arch critique (3 HIGH findings resolved: CRIT-01, CRIT-06, CRIT-11)
• Security audit (SEC-01 path traversal fixed, SEC-02/04/05 acceptable)
• Perf analysis (PERF-01 timeout fixed, PERF-02 caching noted as follow-up)
• Code review approved after blocker fixes

Closes #2447