track(merged): feat: Guardrail prerequisites — outbound deny recording + on_error policy (ext#395)

[huang195]

Tracking stub for merged PR kagenti-extensions#395 — auto-created so it rolls up as completed work under epic #1458.

#395

Closed because the PR is already merged. Label epic-progress marks auto-created trackers.