- Introduces `isToolPotentiallyAllowed` to the `PolicyEngine` to evaluate if a tool could be permitted under current modes and rules, without executing it.
- Correctly handles global rules, specific tool rules, wildcards, and conditional (argsPattern) rules.
- Adds comprehensive unit tests for the new method.