fix: close DSH scanner and runtime protection bypasses

[Mr-Lucky]

Summary

Fix DSH scanner and runtime protection bypasses by:

• scanning generated runtime code under dist/ and build/ during DSH installation scans;
• requiring approval for MCP and skill-install actions under the default runtime policy;
• requiring an explicit decision for unknown DSH tools in protect mode;
• restricting recursive-protection exemptions to the four exact AgentGuard-owned DSH tools;
• short-circuiting downstream execution after a final deny decision.

Adds regression coverage and updates the DSH runtime/API documentation and changelog.

Type

• Bug fix
• New feature / detection rule
• Refactoring
• Documentation

Testing

• npm run build passes
• npm test passes (537 tests)
• Manually tested the change

Related Issues

Closes #

[github-actions]

AgentGuard PR Review

I found one actionable issue.

1. severity: critical — src/dsh/runtime.ts (applyUnknownToolDecision in the first patch)
   • What can go wrong: In protect mode, unknown tools now default to ask, but the new logic never applies the configured unknownToolDecision: 'deny' unless the action is already classified as other. More importantly, the pre-execute protector short-circuits only after AgentGuard evaluation, so a tool that is classified as allow by the shared evaluator but should be denied as unknown can still proceed if the downstream policy returns allow and the action is not recognized as other. This creates a bypass for unclassified tool invocations, weakening the intended “close runtime protection bypasses” change.
   • Concrete fix: Ensure unknown-tool handling is enforced before any downstream execution based on the raw tool name classification, not only on action.actionType === 'other'. If the tool name cannot be mapped to a known safe action, force the configured unknownToolDecision (ask/deny) regardless of the shared evaluator result, and short-circuit downstream execution for deny.