Function ensure_gemini_policy 

fn ensure_gemini_policy() -> Result<String, String>

Write GEMINI_DENY_ALL_TOOLS_POLICY where --policy can read it, and return its path. Under the AgentMux data dir rather than a shared temp dir, where another local user could swap in a permissive policy. Written to a temp file and renamed, so a concurrent /btw never reads a half-written policy.