Function evaluate_tool_policy 

pub fn evaluate_tool_policy(
    cfg: &ToolPolicyConfig,
    tool_name: &str,
) -> PolicyDecision

Evaluate tool_name against the configured policy. Pure — callers handle audit logging and short-circuiting.