[exploratory] Would a pre-flight ATR guardrail template fit this repo?

## Summary (exploratory)

Would an optional pre-flight ATR (Agent Threat Rules) guardrail template fit this repo?

## What ATR is

ATR is an MIT-licensed open detection ruleset for AI-agent threats — 314 YAML rules covering prompt injection, MCP tool poisoning, SKILL.md compromise, context exfiltration, and cross-agent attacks. Distributed via `pip install pyatr` and `npm install agent-threat-rules`.

Current ecosystem adoption:
- Merged upstream by Cisco AI Defense ([skill-scanner#79](https://github.com/cisco-ai-defense/skill-scanner/pull/79)) and Microsoft Agent Governance Toolkit ([agent-governance-toolkit#908](https://github.com/microsoft/agent-governance-toolkit/pull/908)).
- Benchmarks: 97.1% recall on NVIDIA garak's 666 in-the-wild jailbreak corpus; 100% recall on 498 labeled SKILL.md samples; 0 false positives on 432 benign skills.
- Paper: [doi:10.5281/zenodo.19178002](https://doi.org/10.5281/zenodo.19178002)

## Why it might fit Agent Starter Pack

Agent Starter Pack ships production-ready Vertex AI agents with CI/CD, eval, and observability. Guardrails are the column next to eval — teams deploying ADK agents to Vertex currently have no turnkey way to scan MCP servers, sub-agent tool definitions, or fetched context for known attack patterns *before* runtime. A starter template would plug that gap without bolting on vendor infra.

## Concrete integration sketch (small, additive, reversible)

Starting with the `adk` template only (not all six):

1. Optional `guardrails/atr/` module that wraps `pyatr` for pre-flight scanning
2. One `make atr-scan` target wired into the existing `make test` — scans agent tool manifests + MCP server configs
3. Optional runtime hook on tool-definition load that flags high-severity matches (default: log-only, not blocking)
4. `pyatr` as a dev dependency in `pyproject.toml` — not runtime-required
5. Tests across the CONTRIBUTING-required 3 combinations (primary + alt-agent + alt-deployment)

Zero external service, zero telemetry, Apache-2.0-compatible MIT.

## Ask

Before opening a PR I want to check fit:

- Would the maintainers welcome a guardrail template contribution?
- If so, is the preference:
- (a) a new standalone template (e.g. `adk_guarded`)
- (b) an opt-in module inside an existing template
- (c) a CI-only integration (no runtime hook)
- Or is this out of scope for Agent Starter Pack today?

Happy to follow whatever path matches the repo's direction — or a quick "not yet" saves everyone cycles.