fix(core): fail closed on empty tool arguments

[hsusul]

Summary

This pull request treats missing or blank function-tool argument strings as uninspectable for callable needs_approval policies.

parse_function_tool_arguments previously used arguments or \"{}\", so \"\" and None became an empty object. A content gate such as \"refund\" in params.get(\"subject\", \"\") then returned False and the tool ran without interruption. Invalid JSON already failed closed after #3867; empty/missing argument strings now do the same. An explicit \"{}\" payload is still a valid empty object.

The same helper is used by Runner tool execution and Realtime session tool calls.

Test plan

• uv run pytest -q tests/test_hitl_error_scenarios.py::test_callable_function_approval_fails_closed_for_invalid_arguments tests/realtime/test_session.py::TestToolCallExecution::test_callable_function_approval_fails_closed_for_invalid_arguments
• make format && make lint && make typecheck
• Confirmed empty argument strings interrupt and do not invoke the approval predicate

Issue number

N/A

Checks

• I've added new tests, if relevant
• I've run .agents/skills/code-change-verification/scripts/run.sh
• I've confirmed format, lint, typecheck, and focused approval tests pass
• If using Codex, I've run /review before submitting this PR