Proposal: fail-closed AgentFuse gate in `before_tool_callback`

## Execution boundary

ADK already gives community plugins a precise pre-dispatch boundary: `PluginManager.run_before_tool_callback()` runs before `functions.py` calls the tool, and a non-`None` callback result short-circuits that dispatch. `ToolContext.function_call_id` also supplies the original call identity.

I built a bounded integration patch against `396da17a9597d8d5f96e7e1aa8c1c396c738d146` that maps this boundary to the experimental [`dhms-agentfuse==3.7.3`](https://pypi.org/project/dhms-agentfuse/) package:

- `AgentFuseGovernancePlugin` evaluates a configured `RuntimeGuard` in `before_tool_callback`;
- `allow` returns `None`, leaving approval, dispatch, execution outcome, retries, and completion owned by ADK;
- `block` returns a terminal `policy_denied` / `not_executed` response before the tool body starts;
- the immutable decision is retained by the original `function_call_id`;
- the dependency is an opt-in `agentfuse` extra, not a default dependency.

## Working proof

The patch includes two real `LlmAgent` + `InMemoryRunner` tests using ADK's actual plugin and tool-dispatch path:

- allow: protected handler count = 1;
- block: protected handler count = 0;
- both terminal `FunctionResponse` objects preserve the original call ID;
- all plugin tests: `27 passed` on Python 3.12, Google ADK 2.7.1, and AgentFuse 3.7.3.

The implementation is four files: one plugin, one focused test module, one export, and one optional dependency entry. It does not change ADK core or claim that a policy decision is approval or execution success.

If this integration shape fits the community repo, I can push the tested branch and open a Draft PR with the exact patch and test plan.

Beginne mit functions.py und PluginManager.run_before_tool_callback() und verfolge dann ToolContext.function_call_id durch den tatsächlichen Dispatch-Pfad von LlmAgent und InMemoryRunner. Überprüfe das vorgeschlagene Verhalten von AgentFuseGovernancePlugin sowie die beiden im Issue beschriebenen allow/block-Integrationstests. Als abgeschlossen gilt die Arbeit, wenn eine opt-in agentfuse-Abhängigkeit, eine Integration über vier Dateien, ein unverändertes ADK-Kernverhalten und erfolgreiche Plugin-Tests mit den angegebenen Dispatch- und response-ID-Assertions vorliegen.

Vom Indexierungsmodell aus dem Issue-Text verfasst.