…rs subpath (#382)

Ships an opt-in, dependency-free shell risk classifier for the onToolCall gate
(#377). classifyBashCommand(command) returns safe | review | high so users get
the taxonomy from #96 without writing regex tables by hand.

- safe: read-only inspection (ls, cat, grep/rg with a path, git status/log/diff)
- review: context bombs and unknowns (ls -R, find / without -maxdepth,
  grep -r / rg -r without scope, tree, du, unrecognised commands)
- high: destructive/sensitive (rm, sudo, curl | bash, dd, mkfs, chmod 777/-R,
  git push --force, npm publish)

Compound commands are segmented on shell separators and the highest risk wins;
quoted strings are stripped so patterns inside a string do not match. Convenience
heuristic, not a security boundary. Exported only via
@open-multi-agent/core/classifiers so pattern tables never load unless imported.

Closes #379

…example

Third split of #96 (follow-up to #379). The onToolCall gate shipped in #377 and
the classifyBashCommand classifier in #379; this documents both and adds a
runnable example.

- docs/tool-configuration.md: a "Per-call gating with onToolCall" section (where
  it sits, ToolCallContext/ToolCallDecision, deny returns an error ToolResult not
  a throw, agent overrides orchestrator default, orthogonal to onApproval,
  gated/gateAction/gateReason on the trace with gateReason redacted, not a
  security boundary) plus a shell risk classifier subsection.
- examples/patterns/risk-gated-bash.ts: a security-audit agent that classifies
  each bash command and routes safe/review/high to allow/human-approval/deny.
- AGENTS.md: cross-links in the tool-layer notes + /classifiers in the exports map.

Closes #380

…example

Third split of #96 (follow-up to #379). The onToolCall gate shipped in #377 and
the classifyBashCommand classifier in #379; this documents both and adds a
runnable example.

- docs/tool-configuration.md: a "Per-call gating with onToolCall" section (where
  it sits, ToolCallContext/ToolCallDecision, deny returns an error ToolResult not
  a throw, agent overrides orchestrator default, orthogonal to onApproval,
  gated/gateAction/gateReason on the trace with gateReason redacted, not a
  security boundary) plus a shell risk classifier subsection.
- examples/patterns/risk-gated-bash.ts: a security-audit agent that classifies
  each bash command and routes safe/review/high to allow/human-approval/deny.
- AGENTS.md: cross-links in the tool-layer notes + /classifiers in the exports map.

Closes #380

…example (#383)

Third split of #96 (follow-up to #379). The onToolCall gate shipped in #377 and
the classifyBashCommand classifier in #379; this documents both and adds a
runnable example.

- docs/tool-configuration.md: a "Per-call gating with onToolCall" section (where
  it sits, ToolCallContext/ToolCallDecision, deny returns an error ToolResult not
  a throw, agent overrides orchestrator default, orthogonal to onApproval,
  gated/gateAction/gateReason on the trace with gateReason redacted, not a
  security boundary) plus a shell risk classifier subsection.
- examples/patterns/risk-gated-bash.ts: a security-audit agent that classifies
  each bash command and routes safe/review/high to allow/human-approval/deny.
- AGENTS.md: cross-links in the tool-layer notes + /classifiers in the exports map.

Closes #380