Add gateway policy and approval enforcement

[binrogithub]

Motivation

• Provide a small CLI/gateway helper to centralize policy and approval checks before running or applying actions.
• Ensure the apply flow requires explicit approvals (run_id, approve_token, safety_ack) and emits structured results and errors for machine consumption.

Description

• Add a new module cli/gateway.py that implements StructuredError, ToolError, PolicyBlock, RunSummary, and RunnerEnvelope for structured payloads and errors.
• Implement enforce_policy(policy) to raise PolicyBlock or ToolError for blocking/errored policies and enforce_approvals(...) to validate presence of run_id, approve_token, and safety_ack and raise ToolError when missing.
• Add a small CLI with an apply command (parser built by build_parser()), where apply requires --run-id, --approve-token, and --safety-ack, accepts --policy, and returns a RunSummary on success.
• Produce machine-readable output when --json is used by emitting a RunnerEnvelope that contains RunSummary or structured error payloads, and map exit codes to error types (2 = tool error, 3 = policy block, 4 = unexpected exception).

Testing

• No automated tests were run as part of this change; basic behavior exercised during development only (no CI/test harness executed).

---

Codex Task