feat: add Tool Script Safety Guard

[lll-peanut]

实现 Tool 执行脚本的安全检查器，覆盖 6 种风险类型：

• 危险文件操作、网络外连、进程与系统命令
• 依赖安装、资源滥用、敏感信息泄漏
• 可配置 YAML 策略、Filter/Wrapper 接入
• 审计日志 + OpenTelemetry 集成
  Resolves 构建 Tool 执行脚本安全扫描、Filter 拦截与监控机制 #90

[github-actions]

CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅

[lll-peanut]

I have read the CLA Document and I hereby sign the CLA

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@73655ab). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             main        #108   +/-   ##
==========================================
  Coverage        ?   88.10490%           
==========================================
  Files           ?         443           
  Lines           ?       42404           
  Branches        ?           0           
==========================================
  Hits            ?       37360           
  Misses          ?        5044           
  Partials        ?           0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.