## Summary

The tool-permission and tool-policy guardrails (which gate which tools a model may call) are bypassable:

1. **Route coverage gap** (`guardrail_hooks/tool_permission.py:757`). A tool the policy DENIES (`exec_shell`, args `rm -rf /`) is returned **unchecked** when the request goes through the `/v1/responses` and `/v1/messages` (Anthropic) routes — the tool-permission guardrail is enabled but not applied on those routes (it is applied on /chat/completions).

2. **Exact-match blocklist bypass** (`db/tool_registry_writer.py:375` matching, via `guardrail_hooks/tool_policy/tool_policy_guardrail.py:168-186`). A blocked tool reaches the LLM via name variants because the blocklist comparison is exact-match (e.g. case / whitespace / separator variants of the blocked name are not blocked).

## Reproduction (deterministic)

``` --- /chat/completions (control) --- tool exec_shell with args 'rm -rf /': BLOCKED by tool permission guardrail

--- /v1/responses --- tool exec_shell with args 'rm -rf /': ALLOWED (guardrail not applied on this route)

--- /v1/messages (Anthropic) --- tool exec_shell with args 'rm -rf /': ALLOWED (guardrail not applied on this route)

--- tool policy b…