Stdio transport security

Airlock's per-case proxy enforces what a tool's readOnlyHint only claims

An MCP server writes its own danger label, so a harness gating approval on annotations is asking the suspect for its record. Airlock exercises the tools first, then puts the resulting policy in front of every call.