fix(tool-approval-guard): narrow the shipped defaults (v0.3.1)

[veeqtoh]

The v0.3.0 defaults blocked legitimate tool calls. entities was derived from PIIRedactorDefaults, which includes email, and the default action is block so any agent with a mail, SMS or HTTP tool had its normal operations rejected.

scan_injection: true had the same problem: prose written for a human reader matches the patterns ("You are now subscribed to weekly updates.").

With the shipped defaults, 4 of 5 ordinary operations blocked.

Changes

• entities defaults to credit_card, api_key, bearer_token. The others remain supported, opt-in.
• scan_injection defaults to false.
• ToolApprovalGuardDefaults no longer derives from PIIRedactorDefaults. An architecture test pins them apart.
• New dataset asserts both directions: ordinary operations pass, card/key/token block.
• Docs: corrected the wording implying presence of sensitive data is itself an exfiltration signal, and documented that action: 'log' is not observe-only unless block_entities is empty.

Every change loosens a default, so nothing that worked on v0.3.0 stops working. block_entities is unchanged.

Verification

Test passing.