fix(governance): agent argument named "tool" bypasses the sensitive-tool approval gate

[sxyrxyy]

The problem

Some tools are on a watchlist (payment_execute, admin_api, file_delete, database_write). When an agent uses one, governance (GOV-001) is meant to stop and require human approval.

The action dict it checks was built as {"tool": tool_name, "type": "tool_call", **tool_input}. The agent's own arguments get spread in last, so an argument named tool overwrites the real tool name. GOV-001 then checks the fake name, sees something harmless, and skips approval.

Impact: a prompt-injected agent calls payment_execute with an argument {"tool": "noop"} and the approval gate never fires. With enforce=True the dangerous tool just runs. Even in observe-only mode, the signed attestation records it as governance: pass, so the audit trail certifies a check that never happened. The same trick overrides type, which the type-keyed rules rely on.

The fix

Spread the agent's arguments first so the trusted tool/type fields always win:

{**tool_input, "tool": tool_name, "type": "tool_call"}

Keeps the flat action shape, so GOV-003 still reads action["amount"]. The sibling decision-record paths already nest arguments safely and are unchanged.

Verified

Through the real adapter path with enforce=True: the poisoned call now resolves to payment_execute and is denied (escalate, fail-closed with no approval handler). The honest call is unchanged. Existing test suite unaffected (the async adapter tests fail identically on main without this change; they need pytest-asyncio, unrelated to this fix).

[sxyrxyy]

Superseding with a fresh branch for a clean history.