feat: harden gateway with policy engine, secure tools, and governance docs

policy.yaml

@@ -0,0 +1,8 @@
+defaults:
+  read: allow
+  write: deny
+
+tools:
+  deny: []
+
+repositories: {}