### What happened

With the Presidio guardrail configured with `output_parse_pii: true`, PII placeholders are correctly restored in `message.content` on the way back to the client, but are **never restored inside `message.tool_calls[].function.arguments`** — the raw placeholder text (e.g. `<PERSON_1>`, `<PHONE_NUMBER_2>`) reaches the caller instead of the original value.

This is on the standard **OpenAI-compatible** `/v1/chat/completions` path (not the Anthropic-native path covered by #22821), reproduced identically across two different underlying model providers, which rules out a provider-specific cause.

### Reproduction

Guardrail config (via `PATCH /guardrails/{id}`, `mode: ["pre_call", "post_call"]`, `output_parse_pii: true`, otherwise default Presidio settings).

**Case A — plain content, WORKS correctly:**

``` POST /v1/chat/completions { "model": "gpt-5.4", "messages": [{"role": "user", "content": "My email is jane.doe@example.com. Repeat my email back to me exactly."}] } ``` Response: `"content": "jane.doe@example.com"` — correctly unmasked.

**Case B — same request, but the model calls a tool, BROKEN:**

``` POST /v1/chat/completions { "model": "gpt-5.4", "messa…