Function resolve_tool_policy 

pub fn resolve_tool_policy(rules: &[ToolRule], tool_name: &str) -> ToolPolicy

Resolve the effective policy for tool_name against an ordered rule list.

Precedence: exact-name match > longest-prefix glob (trailing *) > default (Ask).