feat: add script safety guard

[ha0924]

概述

新增 Script Safety Guard 模块，对 LLM 生成的 Python/Bash 脚本在执行前进行静态安全分析，输出三级决策（ALLOW/WARN/DENY）。
Closes #90

实现说明

接入方式

两种模式可选：

# 方式一：Filter 模式（在 tool 执行前拦截）
from trpc_agent_sdk.tools.safety import ScriptSafetyFilter
filter = ScriptSafetyFilter()

# 方式二：Wrapper 模式（包装代码执行器）
from trpc_agent_sdk.tools.safety import SafeCodeExecutor
executor = SafeCodeExecutor(inner_executor)

静态扫描机制

• Python：基于 AST 解析，提取 import、函数调用、属性访问等节点进行模式匹配
• Bash：逐行正则扫描命令名、参数、管道、重定向等特征

不执行代码，纯静态分析。

规则扩展

继承 BaseRule，实现 check() 方法，通过 @RuleRegistry.register 装饰器自动注册：

from trpc_agent_sdk.tools.safety.rules._base import BaseRule, RuleRegistry

@RuleRegistry.register
class MyCustomRule(BaseRule):
    rule_id = "CUSTOM_001"
    def check(self, context: ScanContext) -> list[Finding]:
        ...

策略文件配置

默认零配置即可使用。如需自定义，创建 YAML 文件并通过环境变量指定：

export TOOL_SAFETY_POLICY_PATH=./tool_safety_policy.yaml

策略文件支持配置网络白名单、文件路径白名单、禁止进程列表、资源限制阈值等，示例见 examples/safety/tool_safety_policy.yaml。

文档与复现提示词

文件	说明
docs/mkdocs/zh/script_safety_guard.md	中文使用文档
docs/mkdocs/en/script_safety_guard.md	英文使用文档
trpc_agent_sdk/tools/safety/script_safety_guard_reproduction_prompt.md	实现复现提示词（可交给 AI 从零复现整个模块）

影响范围

纯新增模块，无 breaking change，不影响现有代码。

[github-actions]

CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅

[codecov]

Codecov Report

❌ Patch coverage is 97.02970% with 39 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@73655ab). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
trpc_agent_sdk/tools/safety/guard.py	93.98496%	8 Missing ⚠️
trpc_agent_sdk/tools/safety/_metrics.py	81.25000%	6 Missing ⚠️
...agent_sdk/tools/safety/adapters/wrapper_adapter.py	92.00000%	6 Missing ⚠️
trpc_agent_sdk/tools/safety/policy.py	94.59459%	6 Missing ⚠️
..._agent_sdk/tools/safety/adapters/filter_adapter.py	94.04762%	5 Missing ⚠️
trpc_agent_sdk/tools/safety/rules/resource.py	96.59091%	3 Missing ⚠️
trpc_agent_sdk/tools/safety/rules/file_ops.py	97.93814%	2 Missing ⚠️
trpc_agent_sdk/tools/safety/rules/network.py	98.09524%	2 Missing ⚠️
trpc_agent_sdk/tools/safety/models.py	98.78049%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main        #149   +/-   ##
==========================================
  Coverage        ?   87.79422%           
==========================================
  Files           ?         486           
  Lines           ?       45331           
  Branches        ?           0           
==========================================
  Hits            ?       39798           
  Misses          ?        5533           
  Partials        ?           0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ha0924]

I have read the CLA Document and I hereby sign the CLA