add tool script safety guard

[March-77]

Summary

• add a configurable Python and Bash script safety scanner with allow, deny, and human-review decisions
• add a pre-execution Tool Filter and generic guard wrapper with JSONL audit events and OpenTelemetry attributes
• add configurable domain, command, path, timeout, and output-size policies
• add CLI usage, example reports, integration documentation, and acceptance coverage for the 12 required scenarios

Why

Script-capable tools currently rely primarily on execution-time restrictions. This change adds a fast policy layer before execution so dangerous file access, unapproved network egress, process spawning, dependency installation, resource abuse, and secret exposure can be blocked or escalated for review with actionable evidence.

The guard complements rather than replaces sandbox isolation. Runtime CPU, memory, filesystem, network, and process restrictions remain necessary and are documented explicitly.

Validation

• python -m pytest tests/tools/safety/test_tool_script_safety.py -q (18 passed)
• python -m pytest tests/filter tests/tools -q (685 passed)
• CLI allow and deny paths verified
• 500-line scan completes below the one-second acceptance threshold
• python -m compileall -q trpc_agent_sdk/tools/safety scripts/tool_safety_check.py tests/tools/safety

Closes #90

[github-actions]

CLA Assistant Lite bot:
Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request}

[codecov]

Codecov Report

❌ Patch coverage is 91.57895% with 24 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@e113610). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
trpc_agent_sdk/tools/safety/_guard.py	79.79798%	20 Missing ⚠️
trpc_agent_sdk/tools/safety/_scanner.py	96.49123%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main        #172   +/-   ##
==========================================
  Coverage        ?   87.56871%           
==========================================
  Files           ?         472           
  Lines           ?       44388           
  Branches        ?           0           
==========================================
  Hits            ?       38870           
  Misses          ?        5518           
  Partials        ?           0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.