pub fn evaluate_command(line: &str, context: &PolicyContext) -> Decision
Decide whether a tool call may run.