Add schema-validating policy helpers for tool runtime

[gut-puncture]

Summary

This PR adds schema helper support for tool policies and integrates it with the current tool runtime.

Changes:

• adds validate_input_schema(args, schema) -> str | None in concordia/document/tool_policy.py
• adds SchemaValidatingPolicy(delegate: ToolPolicy | None = None)
  • denies when schema validation fails
  • delegates when validation passes and delegate is provided
  • allows when validation passes and no delegate is provided
• adds focused unit tests for schema validation and delegate sequencing
• adds integration tests showing observe/enforce behavior with schema-based deny decisions

This branch is intentionally independently mergeable from main, so it includes the core runtime hardening required by these helpers.

Why

Tool.input_schema metadata existed but lacked a first-class, minimal helper path. This PR makes it practically useful without changing default behavior.

Test Coverage

• valid args
• missing required field
• wrong primitive type
• delegate sequencing
• runtime integration in observe/enforce modes

Validation

Executed locally:

• . .venv/bin/activate && python -m pytest -q concordia/document/tool_policy_test.py
• . .venv/bin/activate && python -m pytest -q concordia/document/interactive_document_tools_test.py
• . .venv/bin/activate && python -m pytest -q concordia/document
• . .venv/bin/activate && python -m pylint --errors-only on touched files