feat(tools): add ToolPolicy for governance and compliance controls

[imran-siddique]

Summary

Implements the Tool Usage Policies proposal (formerly PR #174) as accepted by @dhilloulinoracle and @cesarebernardis.

This adds governance and compliance controls to the Agent Spec tool model, enabling declarative policy enforcement for tool invocations.

Changes

File	Change
tools/toolpolicy.py	New module: ToolPolicy, RateLimitGuard, ApprovalGuard, JustificationGuard models
tools/tool.py	Added optional tool_policy field with version gating (>= 26.2.0)
tools/toolbox.py	Added optional tool_policy field with version gating (>= 26.2.0)
tools/init.py	Export new types
init.py	Export ToolPolicy from top-level package
tracing/events/policy.py	PolicyViolation event for audit trails
tests/serialization/test_tool_policy.py	16 tests covering model validation, serialization, round-trip

Design Decisions

• Used Literal types (not enums) for data_classification and on_violation to match existing serialization patterns (RetryPolicy, jitter)
• ToolPolicy is a non-Component BaseModel (like RetryPolicy) embedded via field reference
• Guards use a discriminated union on the type field
• Version gated to 26.2.0 (current version) so older specs are unaffected
• Composition rules documented in docstrings (stricter wins for classification, union for guards, intersection for allowed_callers)

Testing

All 16 new tests pass. Existing tool serialization tests unaffected (13/14 pass; 1 pre-existing crewai sandbox failure unrelated to this change).

[imran-siddique]

cc @dhilloulinoracle @cesarebernardis - this implements the Tool Usage Policies proposal you both approved in #174. Fresh implementation PR as discussed. Let me know if you'd like any changes.

[oracle-contributor-agreement]

Thank you for your pull request and welcome to our community! To contribute, please sign the Oracle Contributor Agreement (OCA).
The following contributors of this PR have not signed the OCA:

• PR author: imran-siddique
• imran.siddique@microsoft.com (@imran-siddique)
• 223556219+copilot@users.noreply.github.com

To sign the OCA, please create an Oracle account and sign the OCA in Oracle's Contributor Agreement Application.

When signing the OCA, please provide your GitHub username. After signing the OCA and getting an OCA approval from Oracle, this PR will be automatically updated.

If you are an Oracle employee, please make sure that you are a member of the main Oracle GitHub organization, and your membership in this organization is public.

[imran-siddique]

@sonleoracle I signed the OCA about 24 hours ago at oca.opensource.oracle.com with GitHub username \imran-siddique. The check is still showing as not approved. Could you help verify the OCA status or point me to someone who can expedite the approval? Happy to re-sign if something went wrong on my end.