Add host-side action boundary wrapper for agent function tools

[aruintelligence]

What this adds

• createGuardedToolExecute wraps one host-owned function tool callback with the existing proposed-action plan, exact policy rule, proposal-digest approval, and dispatch receipt.
• A runnable no-network demo and an adoption guide show where to attach it to a function tool, including OpenAI Agents SDK wiring, without claiming to intercept other tool paths.
• Focused tests cover destination denial, stale approval, mutation during awaited approval, policy revocation, callback uncertainty, and malformed input. README and pilot links make the path discoverable.

Verification

• node --test test/action-boundary-guarded-tool.test.js test/action-boundary-challenge.test.js test/action-lab.test.js
• node pilots/action-boundary/guarded-tool-demo.mjs
• node scripts/run-action-boundary-challenge.mjs --self-test

The demo approval and dispatch are simulated. This adapter imports the project reference boundary; it is not an independent implementation or a production authorization system.