Sec #4: Harden tool call logging

[kgprs]

Summary

• Run secret blocking before built-in tool call logging when both gateway options are enabled.
• Stop logging raw tool argument values; log argument shape metadata instead.
• Add regression tests proving blocked secret-shaped arguments do not appear in logs.

Validation

• go test ./pkg/secretsscan ./pkg/interceptors ./pkg/gateway