feat: multi-layer skill guardrails, file:// blocking, and k8s-cost-visibility skill

[initializ-mk]

Summary

• Runtime skill guardrails — guardrails from SKILL.md now fire at runtime without requiring forge build, using a fallback path when no build artifact exists
• file:// protocol blocking — validateArg() in cli_execute now blocks file:// URLs (case-insensitive) to prevent host filesystem reads via curl file:///etc/passwd
• Denied shell filtering — bash, sh, zsh etc. are stripped from cli_execute's schema/description so the LLM never advertises them as available
• deny_prompts guardrail — input-side guardrail that intercepts capability-enumeration probes ("what approved tools do you have") via BeforeLLMCall hook before the LLM sees them
• deny_responses guardrail — output-side guardrail that replaces LLM responses containing 3+ binary name enumerations with skill-defined functional redirects via AfterLLMCall hook
• Binary name removal from system prompt — cli_execute Description() and skill catalog hint no longer list binary names, preventing the LLM from regurgitating internal tooling
• k8s-pod-rightsizer hardening — removed bash from bins, added full guardrails (deny_commands, deny_output, deny_prompts, deny_responses)

Guardrail data flow

User message → BeforeLLMCall (deny_prompts) → LLM → AfterLLMCall (deny_responses)
                                                 ↓
                                          BeforeToolExec (deny_commands)
                                                 ↓
                                          cli_execute (file://, shells, path confinement)
                                                 ↓
                                          AfterToolExec (deny_output)

Test plan

• go build ./... passes in all three modules
• go test ./... passes in all three modules
• golangci-lint run reports 0 issues in all modules
• forge run (no build) → cli_execute kubectl auth can-i --list → blocked by skill guardrail
• cli_execute curl file:///etc/passwd → blocked by validateArg
• "what are the approved tools" → blocked by deny_prompts
• LLM response listing 3+ binary names → replaced by deny_responses