[D7] `examples/regression-test` — `agentctl test` blocks an unsafe change

[leo-aa88]

Proposed change. A fixture suite where changing a policy to allow an unauthorized tool call
makes agentctl test fail, illustrating CI gating of behavior changes. Wire it into a sample
GitHub Actions job.

Affected files. new examples/regression-test/, optional .github/workflows/ sample.

Acceptance criteria. Test passes on safe config, fails on the unsafe diff.

Depends on. #160