#8 add lua hol guard adapter

Summary by cubic

Adds a HOL Guard command-safety adapter for lua-utcp so tool calls can be classified by HOL Guard before dispatch.

The adapter shells out to hol-guard command test <command> --json, maps the classification to allow/deny/review/error, and fails closed on missing executables, malformed output, unknown results, or unmapped tool calls. A new utcp.guards module exposes it, with an example CLI wrapper and a test suite covering safe, blocked, reviewed, malformed, unclassified, and unavailable classification paths. The rockspec is bumped to 1.6-1.

New Features

• Adds utcp.guards.hol_guard.new() with configurable command_for, executable, unmapped_decision, and approve callback options.
• Adds examples/hol_guard.lua demonstrating interactive approval for review decisions.