Integrate Bedrock Guardrails API in GuardrailsHook (currently a no-op placeholder)

## Problem

`src/platform_agent/foundation/hooks/guardrails_hook.py` accepts optional `Callable` validators but ships with `None` defaults, meaning **guardrails are effectively disabled out of the box**.

```python
def __init__(self, input_validator: Callable | None = None,
output_validator: Callable | None = None) -> None:
```

For a sample project showcasing Bedrock agent best practices, this undermines the production-readiness narrative. Users may assume guardrails are active when they're not — a "designed but not connected" problem that the project's own `docs/MEMORY_DEEP_DIVE.md` explicitly warns about.

## Proposed Solution

Integrate with the [Bedrock Guardrails API](https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails.html):

1. Accept `guardrail_id` and `guardrail_version` as constructor parameters
2. Call `ApplyGuardrail` in `on_before_invocation` for input validation
3. Call `ApplyGuardrail` in `on_after_invocation` for output validation
4. Keep the custom `Callable` validators as an additional layer for domain-specific rules
5. Add a `DomainHarness` config field for guardrail ID so it can be set via YAML

## Acceptance Criteria

- [ ] `GuardrailsHook` calls Bedrock Guardrails API when `guardrail_id` is configured
- [ ] Blocked input/output returns a safe, configurable message
- [ ] Falls back gracefully when no guardrail_id is set (current behavior)
- [ ] Unit tests cover both API-backed and custom-callable paths
- [ ] Example in `plato_harness.yaml` shows guardrail configuration