[Proposal] Record a toolCallResult that names a denied request #304

Part of issue #118. Raised in the PR #272 review.

The problem

hooks.md (toolCallResult) says a Guardian SHOULD resolve request_id_ref against the session's toolCallRequest records, and MUST record a reference it can't resolve. A reference to a request the Guardian denied resolves fine, so nothing gets recorded.

That's backwards for the case that matters most. If a host runs a tool the Guardian denied and then honestly reports the result, the result names the denied request. That's the clearest evidence a Guardian ever gets that a host ignored a DENY, and today it passes as normal.

The reference Guardian shows it: recordUnresolvedRequestIdRef in reference-implementations/agt/packages/guardian/src/server.ts checks only that the request exists, because the chain entry is written before any verdict exists.

Why the wire has to carry it

The wire already carries it. request_id_ref is on the result. The open question is what a Guardian MUST do with a reference that resolves to a denied, deferred, or still-pending request.

Decision needed

1. Should a reference to a request the Guardian answered deny (or defer, or an ask that was never granted) be recorded as its own finding, distinct from "unresolved"?
2. Should it be a MUST or a SHOULD?
3. Related and smaller: should a reference also fail to resolve when the result's tool.name differs from the request's, or when an earlier result already used the same reference?
4. Where does the record live? hooks.md says "audit record" without defining it. The reference Guardian writes findings to its envelope log (stderr as a fallback), outside the §8.6 hash chain, so a Guardian can drop one without leaving a trace. Should a finding be a ContextEntry the published chain_hash commits to?
5. Should a finding say why the reference didn't resolve (a Guardian restart, an evicted session, or a request that never reached the Guardian)? Without that, routine findings bury the one that matters.

Constituencies

Guardian implementers, auditors and incident responders.