refactor: extract early-return security gates from call_tool_guarded (cc 185)

[cedric013]

Summary

Closes #771.

call_tool_guarded (rust/src/server/call_tool.rs) has cognitive complexity 185 — the worst hotspot in the repo — and is ~1000 lines. It chains several independent early-return security gates inline before dispatch.

This extracts the three self-contained gates into helpers returning Option<CallToolResult>:

• guard_role_and_policy — role + context-policy-pack tool-access gating
• guard_egress — egress / output DLP on agent writes & actions
• guard_workflow — workflow allow-list gating

The dispatcher now calls them in the exact same order, each still short-circuiting via return Ok(blocked) on Some. guard_name/guard_args are intentionally kept inline because they are reused by the later permission-inheritance gate.

Scope: this is a conservative, security-preserving reduction of the prelude only. The risky dispatch + post-processing section (panic-catch, elicitation, finalize) is deliberately left untouched for a separate follow-up.

Test plan

• cargo build --lib
• cargo test --lib -- server::call_tool -> 7 passed
• cargo test --lib -- workflow role_guard policy_guard egress -> 31 passed
• cargo fmt --check
• cargo clippy --lib --all-features -- -D warnings clean for call_tool.rs (only remaining error is the unrelated pre-existing rules_overhead.rs:143 lint on main, fixed by fix: silence clippy::map_unwrap_or in rules_overhead (unblocks Clippy CI) #767)

Notes for reviewers

• Risk areas: security gates — verified the extraction preserves call order and short-circuit semantics; each gate's body was moved verbatim (return Ok(x) -> return Some(x), trailing None).
• Backwards compatibility: behaviour unchanged.

[yvgude]

Reviewed the call_tool_guarded security gate extraction.

Verified:

• Three guards extracted with correct Option<CallToolResult> return type:
  • guard_role_and_policy (sync) — role + context-policy-pack
  • guard_egress (sync) — egress / output DLP
  • guard_workflow (async, needs &self.workflow) — workflow allow-list
• Gate ordering preserved: role → ctx_call resolution → egress → workflow (same short-circuit semantics)
• Verbatim move — return Ok(x) → return Some(x), trailing None
• ctx_call inner-tool resolution correctly stays inline (shared with permission-inheritance gate)
• Dispatch + post-processing intentionally untouched (deferred to follow-up)
• Clippy fixes in rules_inject/content.rs, chatgpt_ws.rs, signing.rs are all minor and correct
• LEAN-CTX.md refresh is cosmetic

Security-critical path — gate order and short-circuit behavior are the key invariants. Both are preserved.

Approved.