toolgate: more value checks, list elements and nested arguments

[cinar]

Depends on #64. Please review and merge #64 first. This branch is stacked on it, so until #64 merges this PR also shows #64's two commits. Only the last commit, 785de45, is new here.

Extends aex-toolgate's argument-value rules in the same style: declarative, deterministic, fail closed, one record per call. The existing kinds' checks and messages are unchanged, and all existing tests pass.

New rule kinds

kind	checks	example
floor	numeric minimum (min)	quantity ≥ 1
denylist	denied values, compared without regard to case	never pay NEW-ACCT-9911, nor new-acct-9911
pattern	an RE2 expression the whole value must match (RE2 can't be driven into exponential time)	IDs look like ACME-ACCT-\d{3}
domain	the host of an email address, a URL or a bare host name is in allowed or a subdomain of one	cfo@eu.corp.example passes; cfo@evilcorp.example and https://corp.example@evil.example don't
max_items	at most max items in a list (a lone value counts as one)	at most 3 recipients
compare	arg op match_arg must hold: lt/le/gt/ge on numbers, eq/ne on numbers or plain values	a refund may not exceed the original charge

domain parses the value rather than matching a suffix, so URL userinfo tricks resolve to the real host. Several @ signs or a non-ASCII (homoglyph) host fail closed.

Lists and nested arguments

• each: true applies a single-value rule to every element of a list argument, and to a lone value as a list of one. Without it a list still fails closed, as today. Allowed on ceiling, floor, allowlist, denylist, suffix, prefix, pattern, domain and sensitive_field.
• Paths: arg and match_arg may be paths. payment.amount reads a field of an object argument; items[*].amount reads the field of every element of a list, each of which is checked. An argument literally named with a dot is found by its exact name first. A path missing from the call, or running into a value of the wrong shape, fails closed like an absent argument. Lookup rules resolve paths too.

How

Rule.evaluate is split into argument resolution (resolveArg: plain argument, path, or [*] path) and a per-value checkValue. The existing switch moved into checkValue verbatim, changing only its return shape, so every existing kind decides and explains exactly as before.

Validation

The policy is refused when:

• floor has no min;
• denylist has an empty list;
• pattern is missing or doesn't compile;
• a domain entry isn't a bare lower-case ASCII domain (e.g. @corp.example, Corp.example);
• max_items has max below 1;
• compare has a bad op or no match_arg, or uses [*] on either side;
• each is set on a kind that doesn't check single values;
• a path is malformed (a..b, a[*]b).

Tests

values_test.go covers:

• each new kind, including its fail-closed cases (quoted numbers, padding, several @, a homoglyph host, a URL without a host);
• each over lists, including the unchanged behaviour without it;
• nested and [*] paths, and an argument literally named with a dot;
• compare on flat and nested arguments;
• every validation error.

Everything passes under -race (the pattern cache is shared across requests).

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ptdu2pZMVdE5x6XkwcUDjj