feat(ai): expose authorized tool call details

[first-assist]

Summary

• add a default-deny host projection seam for browser-safe tool arguments
• return exact public application-tool failure envelopes for owner-authorized failed read calls
• preserve current principal, session/scope, descriptor, disclosure-schema, classification, and payload bounds
• bump graphql-orm-ai to 0.92.0 with migration and release documentation

Security invariants

• existing hosts disclose no arguments unless they explicitly opt in
• projected arguments are independently authorized and capped at 64 KiB
• failed calls expose only the crate-authored four-field public envelope after exact state/code/payload validation
• stale or missing descriptors never expose stored arguments
• Secret-classified results remain unavailable
• repository-wide case-insensitive upstream diff grep for gema: 0 matches

Documentation impact

• Documentation updated
• No documentation impact

Updated the crate README, changelog, migration guide, and generated workspace package inventory.

Gates

• cargo fmt -p graphql-orm-ai --check: pass
• all-provider cargo test -p graphql-orm-ai: pass (398 unit tests plus all integration suites; 38 generated doc tests ignored)
• all-target provider-feature cargo clippy ... -- -D warnings: pass
• default and Pascal-case rustdoc with -D warnings -D missing_docs: pass
• Pascal GraphQL naming test: 1 passed
• PostgreSQL no-default-features check: pass
• MSSQL no-default-features check: pass
• cargo-semver-checks against 0.91.1 with supported default SQLite features: pass
• documentation validation: 187 files
• generated workspace inventory: pass
• package release policy: pass
• git diff --check: pass

All local Rust commands ran through GEMA scripts/run-cargo-bounded.sh; no managed service was restarted.