feat(examples): add supervisor middleware content guard

[pimlock]

Summary

Note

This is example usage of the middleware that is being introduced in #2027

Add a runnable supervisor middleware content-guard example that demonstrates external middleware registration, policy binding, request-body inspection, and allow/deny/redact responses. This is a stacked draft PR based on 1733-supervisor-middleware/pmlocek.

Related Issue

Related to #1733

Changes

• Add a standalone Rust content-guard gRPC service using the supervisor middleware API
• Support configurable term matching with redact and deny modes, findings, and audit-safe metadata
• Add an example middleware policy and setup/run instructions
• Keep the example lockfile reproducible and aligned with the current workspace dependencies

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

The example includes unit coverage for redaction, denial, pass-through, and invalid configuration. No dedicated E2E test is included in this example PR.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

The parent middleware branch contains the corresponding architecture and user-facing middleware documentation; this stacked PR adds the runnable example.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[pimlock]

/ok to test 06c0433