feat(plugins): add TealTiger governance plugin

[amanishimwe]

Summary

• Adds TealTigerPlugin, an App-level wrapper around tealtiger.integrations.google_adk.TealTigerCallback, so PII, allowlist, secret, cost, and freeze policies run on every agent under an App.
• Requires pip install tealtiger. Construction without the SDK (or an injected callback) raises ImportError.

Description of Change

Problem:
TealTiger ships ADK tool hooks as TealTigerCallback.before_tool / after_tool, meant to be attached per agent. ADK plugins run for every agent in an App and use a different callback signature, so those hooks need an adapter.
Solution:
Add TealTigerPlugin(BasePlugin) that forwards plugin tool callbacks to TealTigerCallback by name, passes deny dicts through so ADK skips the tool, and fails closed if evaluation throws.

Testing Plan

Unit Tests:

• Added/updated unit tests
• Pass locally: pytest tests/unittests/plugins/test_tealtiger_plugin.py — 10 passed
  E2E:
• Not run against a published tealtiger package. Live check: pip install tealtiger, put TealTigerPlugin(..., mode="ENFORCE") on an App, call a tool with PII in args, confirm [GOVERNANCE DENIED].

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[wukath]

Thanks @amanishimwe! I don't think we can take it into adk-python -- The plugin targets tealtiger.integrations.google_adk.TealTigerCallback, which no published tealtiger release (1.0.0–1.4.0) actually ships, so it can't work for anyone installing from PyPI today.

TealTiger already ships tealtiger-haystack with an agent-level before_tool hook, and a tealtiger-adk package following that pattern would be better for everyone: they keep release control and the dependency call, and ADK's plugin API is public enough that you need nothing from us to build against it.