Delivered: Pre-call guardrails pipeline with jailbreak detection, content filtering, tool allowlists/denylists, and composable presets.

Key accomplishments:
- Pipeline.run/2 policy middleware chain with halt-on-first-violation
- JailbreakDetector behaviour + default keyword detector (4 scoring categories + base64 evasion)
- ContentFilter with pre/post hooks and ToolPolicy with allow/deny enforcement
- Named presets, from_config/1 with NimbleOptions, full telemetry instrumentation
- 1,005 LOC guardrails lib, 680 LOC tests, 421 tests total

See .planning/MILESTONES.md for full details.