protect-mcp and review-agent-governance: Cedar policies use an entity shape that protect-mcp 0.7 does not evaluate

protect-mcp 0.7.x evaluates every tool call as action == Action::"MCP::Tool::call", resource == Tool::"<tool name>", with the tool input at context.input (for Bash, context.input.command). The test policy at plugins/protect-mcp/test/fixtures/test-policy.cedar was rewritten to that shape in #602 and its comment explains the change.

Every other policy and policy example in both plugins still uses the older shape: action == Action::"Bash", Action::"Read", and so on, with context.command_pattern. Against 0.7.4 those rules never match, so the trailing permit (principal, action, resource) allows every call. I confirmed it directly: evaluate --policy plugins/review-agent-governance/policies/review-agent-governance.cedar --tool Bash --input '{"command":"gh pr merge"}' returns allowed, exit 0.

Files with the old shape:

• plugins/review-agent-governance/policies/review-agent-governance.cedar and .cedarschema
• plugins/review-agent-governance/agents/review-policy-author.md and README.md
• plugins/protect-mcp/skills/protect-mcp-setup/SKILL.md, agents/policy-enforcer.md, and README.md

Found while fixing #701. That PR fixes the hook wiring and keeps the policies unchanged, so its governance test covers the allow path and the approval flag only.

Suggested fix: rewrite the shipped policy, the schema, and every example to the 0.7 shape, match Bash commands with context.input.command like "gh pr merge*" so commands with arguments are caught, and add a test in plugins/review-agent-governance/test/run-tests.sh that pipes a gh pr merge 42 payload through the hook and expects exit 2. The README's list of gated commands should be checked against the policy at the same time.