RFC: deterministic execution boundaries for tool calls (task text is untrusted input)

SWE-agent's maximal-agency design means the task itself (issue text) is untrusted input. In real use (private repos, EnIGMA, custom tasks) a malicious issue body is direct prompt injection into an agent holding shell, GitHub tokens, and API keys. Proposal (optional, default-off): deterministic pre-tool-call policy hook — secret denial, fail-closed egress allowlist, git remote allowlist, per-run spend cap, signed receipts (also makes trajectories auditable for research). Shadow default, hard blocks via flag, zero change when off. Interest in this here or in mini-SWE-agent? Happy to contribute implementation + tests. (Hardening proposal, not a vuln disclosure.)