fix(sdk): enforce workspace approval and block policies on toolkit endpoints (#1752)

[Adityakk9031]

Problem

Workspace approval policies (action: "require_approval") and workspace block policies (action: "block") configured in the tool_policy table were enforced on the base /mcp endpoint and general HTTP API, but were silently bypassed on toolkit-scoped MCP endpoints (/mcp/toolkits/<slug>).

When a toolkit is active, the executor assigned activeToolPolicyProvider. In listActivePolicyRuleSet(), the executor previously branched exclusively to activeToolPolicyProvider, skipping core.findMany("tool_policy", {}). Consequently, the ambient workspace tool_policy table was never evaluated for toolkit endpoints, allowing gated tools to dispatch immediately without approval or pause.

Solution

1. Combine Policies Under Least Privilege (combineEffectivePolicies):
   • If either the toolkit policy (e.g. tool not connected or blocked) or workspace policy is "block", the tool is blocked.
   • If both have explicit user/org rules, the most restrictive rule wins (a toolkit cannot weaken a workspace guardrail, and toolkit restrictions are strictly respected).
   • If only one has an explicit user/org rule, that explicit rule takes precedence over plugin-default annotations.
   • If neither has an explicit user/org rule, fall back to the most restrictive plugin-default.
2. SDK Executor Resolution:
   • listActivePolicyRuleSet() fetches the workspace tool_policy rows across all executor modes.
   • resolvePolicyFromRuleSet() evaluates both the ambient workspace policy and the active provider/prepared resolver, combining them via combineEffectivePolicies.
   • policiesResolve() now routes through listActivePolicyRuleSet() and resolvePolicyFromRuleSet() for consistent resolution.
3. Tests:
   • Added unit tests in packages/core/sdk/src/policies.test.ts verifying workspace require_approval and block enforcement with active toolPolicyProvider.
   • Added tests in packages/plugins/toolkits/src/server.test.ts verifying toolkit-scoped executors enforce workspace policies, cannot weaken workspace approval rules, and block disallowed tools.

Fixes #1752

[Adityakk9031]

@RhysSullivan have a look