feat(intercept): 模型审查补充任务上下文与裁决说明 (#124)

审查模型改为接收版本化 JSON：任务描述/目标/操作约束、工作目录、Worker 意图、当前轮输入，以及按 tool_use_id 配对的近期工具执行记录；末尾是完整的 tool_name 与 arguments。

- 任务约束每次审查从数据库重新读取；读取失败或约束超预算转人工。
- 历史只保留唯一配对的执行事实，排除 Agent 自述、未完成请求与平台拒绝反馈。
- 裁决改为 JSON decision(allow/ask/deny) + comment，三种结果均须说明实际操作、成功后果与命中规则。
- 所有模型裁决（含自动放行）保存实际模型输入与 SHA-256 指纹，详情页可展开。
- 对话审批卡片支持展开完整请求、模型输入、裁决与执行结果。
- 修复父目录 lockfile 导致的 Turbopack 根目录误判。

官方默认拦截规则、工具范围与优先级不变。

guard/guard.go

@@ -75,13 +75,12 @@ func (g *Guard) preToolUse(ctx context.Context, ev hook.Event) hook.Result {
 		cmd = in.Text
 	}
 	g.record(ev.ToolName, "allow", "", cmd)
-	return g.applyIntercept(ctx, ev, cmd)
+	return g.applyIntercept(ctx, ev)
 }
 
 // applyIntercept evaluates user-configured intercept rules against the tool call.
-// It is called after all built-in safety checks pass. cmd is the extracted shell
-// surface (empty for non-shell tools), passed to the LLM fallback judge.
-func (g *Guard) applyIntercept(ctx context.Context, ev hook.Event, cmd string) hook.Result {
+// Both rules and the fallback judge receive the complete tool input.
+func (g *Guard) applyIntercept(ctx context.Context, ev hook.Event) hook.Result {
 	if g.interceptor == nil {
 		return hook.Result{}
 	}
@@ -93,7 +92,7 @@ func (g *Guard) applyIntercept(ctx context.Context, ev hook.Event, cmd string) h
 	if !matched {
 		// No rule matched. Ask the LLM fallback judge (if enabled); when it is off
 		// or unwired, keep current behavior and allow.
-		d, judged := g.interceptor.Judge(ctx, ev.ToolName, judgeSubject(cmd, ev.Input))
+		d, judged := g.interceptor.Judge(ctx, ev.ToolName, ev.Input)
 		if !judged {
 			return hook.Result{}
 		}
@@ -141,16 +140,6 @@ func systemBlockMessage(reason string) string {
 		"原因：" + reason + "。此操作被禁止。"
 }
 
-// judgeSubject builds the text the LLM fallback judge evaluates: the shell
-// command for shell tools, or the raw tool input JSON for others (Write/Edit/…)
-// so the model sees what is being written/requested.
-func judgeSubject(cmd string, input []byte) string {
-	if cmd != "" {
-		return cmd
-	}
-	return string(input)
-}
-
 var reBlocked = regexp.MustCompile(`(?i)\b(403|forbidden|waf|blocked|rate.?limit|429|captcha|denied)\b`)
 
 // postToolUse is the Observer failure-attribution hook (G5): it classifies tool