feat: add ExecInterpreterRule and NetworkHostRule plane-2 rules

apps/server/src/main/kotlin/com/correx/apps/server/Main.kt

@@ -40,6 +40,8 @@ import com.correx.core.validation.semantic.rules.CycleExitRule
 import com.correx.core.validation.semantic.rules.MissingToolRule
 import com.correx.core.toolintent.ToolCallAssessor
 import com.correx.core.toolintent.WorkspacePolicy
+import com.correx.core.toolintent.rules.ExecInterpreterRule
+import com.correx.core.toolintent.rules.NetworkHostRule
 import com.correx.core.toolintent.rules.PathContainmentRule
 import com.correx.infrastructure.InfrastructureModule
 import com.correx.infrastructure.artifactscas.DefaultMaterializingArtifactWriter
@@ -113,7 +115,16 @@ fun main() {
         ?: workingDir
     val privilegedLocations = toolsConfig.privilegedLocations.map { Path.of(it) }
     val workspacePolicy = WorkspacePolicy(workspaceRoot, privilegedLocations)
-    val toolCallAssessor = ToolCallAssessor(rules = listOf(PathContainmentRule()))
+    val toolCallAssessor = ToolCallAssessor(
+        rules = listOf(
+            PathContainmentRule(),
+            ExecInterpreterRule(toolsConfig.interpreterExecutables.toSet()),
+            NetworkHostRule(
+                allowedHosts = toolsConfig.networkAllowedHosts.toSet(),
+                deniedHosts = toolsConfig.networkDeniedHosts.toSet(),
+            ),
+        ),
+    )
 
     val inferenceRouter = DefaultInferenceRouter(infraRegistry, FirstAvailableRoutingStrategy())
     val engines = OrchestratorEngines(