feat: add tool script safety guard

[ha0924]

feature(Tool_Script_Safety_Guard): 工具脚本安全护栏功能

新增工具调用执行前的静态安全审查护栏，对 Python / Bash 脚本做模式扫描，
按策略给出 allow / review / deny 决策，并支持脱敏与审计落盘。

核心模块 (trpc_agent_sdk/tools/safety/):

• engine.py 扫描引擎，编排扫描器并产出决策报告
• policy.py YAML 安全策略（白名单域名、允许命令、forbidden_paths、扫描限制）
• rules.py/models.py 规则定义与数据模型
• scanners/ Python(AST+文本) 与 Bash 扫描器、共享 patterns 检测
• filter.py/wrapper.py 工具调用过滤器与包装器
• audit.py 审计日志（JSONL）

关键能力:

• forbidden_paths 由策略驱动：带边界字面匹配 + ~ 展开，改策略即生效、无需改代码
• /dev /proc /sys 归类 FILE_OVERWRITE_DEVICE，其余 FILE_FORBIDDEN_PATH
• 敏感信息脱敏 + max_line_length 截断防 ReDoS

示例 (examples/tool_safety_guard/):

• run_scan.py / run_with_filter.py 端到端演示，含 12 个样例与 EXPECTED 基线
• 策略、报告、审计产物与 README（含已知限制）

测试 (tests/tools/safety/):

• engine / policy / 扫描器 / 过滤器 / 验收 / forbidden_paths 配置驱动用例
• 12/12 样例决策与 EXPECTED 一致，deny 检出 6/6，安全样本误报 0

工具:

• scripts/tool_safety_check.py CLI 入口

[github-actions]

CLA Assistant Lite bot:
Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

sylviaanhe@tencent.com seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You can retrigger this bot by commenting recheck in this Pull Request}

[ha0924]

已阅读CLA文件，并在此签署CLA文件。