feature(Tool_Script_Safety_Guard): 工具脚本安全护栏功能

新增工具调用执行前的静态安全审查护栏，对 Python / Bash 脚本做模式扫描，
按策略给出 allow / review / deny 决策，并支持脱敏与审计落盘。

核心模块 (trpc_agent_sdk/tools/safety/):
- engine.py        扫描引擎，编排扫描器并产出决策报告
- policy.py        YAML 安全策略（白名单域名、允许命令、forbidden_paths、扫描限制）
- rules.py/models.py  规则定义与数据模型
- scanners/        Python(AST+文本) 与 Bash 扫描器、共享 patterns 检测
- filter.py/wrapper.py  工具调用过滤器与包装器
- audit.py         审计日志（JSONL）

关键能力:
- forbidden_paths 由策略驱动：带边界字面匹配 + ~ 展开，改策略即生效、无需改代码
- /dev /proc /sys 归类 FILE_OVERWRITE_DEVICE，其余 FILE_FORBIDDEN_PATH
- 敏感信息脱敏 + max_line_length 截断防 ReDoS

示例 (examples/tool_safety_guard/):
- run_scan.py / run_with_filter.py 端到端演示，含 12 个样例与 EXPECTED 基线
- 策略、报告、审计产物与 README（含已知限制）

测试 (tests/tools/safety/):
- engine / policy / 扫描器 / 过滤器 / 验收 / forbidden_paths 配置驱动用例
- 12/12 样例决策与 EXPECTED 一致，deny 检出 6/6，安全样本误报 0

工具:
- scripts/tool_safety_check.py CLI 入口

Author: sylviaanhe@tencent.com

tests/tools/safety/test_forbidden_paths.py

@@ -0,0 +1,96 @@
+# Tencent is pleased to support the open source community by making tRPC-Agent-Python available.
+#
+# Copyright (C) 2026 Tencent. All rights reserved.
+#
+# tRPC-Agent-Python is licensed under Apache-2.0.
+"""Tests for policy-driven ``forbidden_paths`` enforcement (acceptance req. 6).
+
+These prove the part of requirement 6 that says *forbidden paths* must be
+tunable from the policy file with **no code change**:
+
+- a path listed in ``forbidden_paths`` is flagged and denied,
+- adding/removing a path in the policy flips the decision with no code change,
+- ``/dev`` / ``/proc`` / ``/sys`` map to ``FILE_OVERWRITE_DEVICE``,
+- boundary matching avoids false positives (``/etcd``, URL paths),
+- the overly-broad ``/`` entry is skipped.
+"""
+
+from __future__ import annotations
+
+from dataclasses import replace
+
+from trpc_agent_sdk.tools.safety.engine import SafetyEngine
+from trpc_agent_sdk.tools.safety.models import Decision
+from trpc_agent_sdk.tools.safety.models import Language
+from trpc_agent_sdk.tools.safety.models import ScanInput
+from trpc_agent_sdk.tools.safety.policy import SafetyPolicy
+
+
+def _policy(forbidden_paths: list[str]) -> SafetyPolicy:
+    """A minimal policy that only configures the forbidden paths under test."""
+    return replace(SafetyPolicy.default(), forbidden_paths=list(forbidden_paths))
+
+
+def _scan(policy: SafetyPolicy, script: str, language: Language = Language.PYTHON):
+    return SafetyEngine(policy).scan(
+        ScanInput(script=script, tool_name="t", language=language))
+
+
+def _rule_ids(report) -> set[str]:
+    return {f.rule_id for f in report.findings}
+
+
+def test_forbidden_path_flagged_and_denied():
+    script = 'open("/etc/cron.d/payload", "w").write("* * * * * root sh")\n'
+    report = _scan(_policy(["/etc"]), script)
+    assert "FILE_FORBIDDEN_PATH" in _rule_ids(report)
+    assert report.decision == Decision.DENY
+
+
+def test_device_path_maps_to_overwrite_device():
+    for forbidden, path in (("/dev", "/dev/sda"), ("/proc", "/proc/1/mem"), ("/sys", "/sys/power/state")):
+        report = _scan(_policy([forbidden]), f'open("{path}", "wb")\n')
+        assert "FILE_OVERWRITE_DEVICE" in _rule_ids(report), forbidden
+        assert report.decision == Decision.DENY
+
+
+def test_config_driven_add_and_remove_no_code_change():
+    """The same script flips decision purely by editing the policy."""
+    script = 'open("/data/prod/secret.txt", "w")\n'
+
+    # Path NOT in the policy -> nothing detected, allowed.
+    before = _scan(_policy(["/etc"]), script)
+    assert "FILE_FORBIDDEN_PATH" not in _rule_ids(before)
+    assert before.decision == Decision.ALLOW
+
+    # Add the path to the policy -> now flagged and denied (no code change).
+    after = _scan(_policy(["/etc", "/data/prod"]), script)
+    assert "FILE_FORBIDDEN_PATH" in _rule_ids(after)
+    assert after.decision == Decision.DENY
+
+
+def test_home_path_expanded():
+    report = _scan(_policy(["~/.ssh"]), 'open("~/.ssh/config")\n')
+    assert "FILE_FORBIDDEN_PATH" in _rule_ids(report)
+
+
+def test_no_false_positive_on_similar_prefix():
+    """A forbidden ``/etc`` must not match ``/etcd`` or a URL path component."""
+    script = (
+        'open("/etcd/data/state.db")\n'
+        'url = "https://example.com/etc/info"\n'
+    )
+    report = _scan(_policy(["/etc"]), script)
+    assert "FILE_FORBIDDEN_PATH" not in _rule_ids(report)
+
+
+def test_root_path_is_skipped_as_too_broad():
+    """A bare ``/`` entry is ignored (every path contains it)."""
+    report = _scan(_policy(["/"]), 'open("/tmp/workdir/output.txt", "w")\n')
+    assert "FILE_FORBIDDEN_PATH" not in _rule_ids(report)
+
+
+def test_bash_forbidden_path():
+    report = _scan(_policy(["/etc"]), "cat /etc/shadow", language=Language.BASH)
+    assert "FILE_FORBIDDEN_PATH" in _rule_ids(report)
+    assert report.decision == Decision.DENY