Org policy guardrails for Team Pro

Two new guardrails enforced inside the plugin. Owners can mark file globs as off-limits to the agent and restrict which MCP clients are allowed to make calls. Defaults are safe; when a call is blocked the plugin tells the developer which policy fired.