fix(tool): harden result envelope contract

[ForeverAngry]

Summary

Close the ToolResultEnvelope contract gaps from #8 before downstream caches and trace consumers depend on the shape.

This adds three pieces to the model-visible envelope boundary:

• redaction policies over JSON Pointer deny/allow lists, applied before truncation or total-size bounding
• path-aware omitted segments with opaque, decodable continuation tokens
• a total serialized-byte budget so large objects with many small fields are bounded, not just per-string/per-array clamped

The raw dispatch path remains unchanged. Bounded helpers still opt in at the model-visible boundary.

Public API

• ToolResultEnvelopeConfig::with_max_total_bytes
• ToolResultEnvelopeConfig::with_redaction_policy
• RedactionPolicy / RedactionRule
• OmittedSegment
• ToolResultOmissionReason
• ToolResultPageToken
• decode_tool_result_page_token

Existing serialized envelopes remain readable because new envelope fields are serde-defaulted where needed.

Validation

• cargo test --test result_envelope --all-features
• just check

Closes #8

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.