feat(examples): add supervisor middleware content guard

[pimlock]

Summary

Add a runnable supervisor middleware content-guard example for the middleware shipped in #2027. The example demonstrates operator-run service registration, policy attachment, request-body inspection, and allow, deny, and redact responses.

Related Issue

Related to #1733

Changes

• Add a standalone Rust content-guard gRPC service using the supervisor middleware API
• Support configurable term matching with redact and deny modes, audit-safe findings, and a stable deny reason code
• Add an example policy using the keyed network_middlewares format and operator-owned registration name
• Add smoke.sh to build and launch the gateway, middleware, and sandbox with automatic cleanup
• Demonstrate the same payload going through a guarded httpbin.org request and an unguarded httpbingo.org request
• Document the smoke flow, openshell.supervisor.middleware registration, body limit, and timeout behavior
• Keep the example lockfile reproducible and aligned with the current workspace dependencies

Testing

• mise run pre-commit passes
• examples/supervisor-middleware-content-guard/smoke.sh --test-suite passes
• cargo test --manifest-path examples/supervisor-middleware-content-guard/Cargo.toml passes
• Unit tests cover redaction, denial and reason code, pass-through, and invalid configuration
• Smoke coverage verifies a selected request is filtered and an allowed unselected request is unchanged

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable, the middleware architecture and user documentation landed in feat(supervisor-middleware): add network egress middleware #2027)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[pimlock]

/ok to test 06c0433

[pimlock]

/ok to test e8e6456