[Phase 0.3.2] Create operator_use/guardrails/ module

[richard-devbot]

Closes #12

What was implemented

Created the full operator_use/guardrails/ package from scratch:

operator_use/guardrails/
├── __init__.py          # Public API exports (16 symbols)
├── base.py              # Abstract base classes + value types
├── action_validator.py  # Pre-execution tool-call validation
├── content_filter.py    # Post-execution output filtering
├── policy_engine.py     # Risk classification and policy decisions
└── registry.py          # Guardrail registration and lookup

Base classes (base.py)

• GuardrailResult — result object with action (allow/block/confirm), reason, severity, metadata, and convenience factories .allow() / .block() / .confirm()
• RiskLevel — safe | review | dangerous
• GuardrailAction — allow | block | confirm
• Guardrail — abstract base with check(context) -> GuardrailResult
• ActionValidator — abstract, requires validate(tool_name, args, context) — pre-execution hook
• ContentFilter — abstract, requires filter(content, context) — post-execution hook
• PolicyEngine — abstract, requires classify_risk(action) returning RiskLevel

Concrete helpers

• AllowAllValidator — passthrough (no-op default)
• BlockListValidator — deny-list of tool names
• CompositeActionValidator — chains validators; BLOCK short-circuits, CONFIRM accumulates
• PassthroughFilter — no-op content filter
• KeywordBlockFilter — case-insensitive phrase deny-list
• RegexFilter — compiled regex patterns
• CompositeContentFilter — chains filters with same BLOCK > CONFIRM > ALLOW precedence
• RuleBasedPolicyEngine — dangerous/review tool-name lists
• CompositePolicyEngine — aggregates engines; DANGEROUS wins

Registry (registry.py)

• GuardrailRegistry — register/unregister by name, get_all(type), get_enabled(type), run_all(type, context), clear()

Tests

57 unit tests in tests/security/test_guardrails_base.py — all passing.

Coverage includes: factory methods, abstract enforcement, allow/block/confirm precedence in composite classes, disabled-guardrail skip, registry CRUD, type-filtered lookup, and run_all dispatch.

Ruff

ruff check — no issues. ruff format — 1 file auto-formatted.