feat(interceptors): initial gateway interceptor implementation and reference example

[drew]

Summary

Implements #1927

Related Issue

#1919

Changes

• Add interceptor, binding, and decision labels to gateway interceptor evaluation counters.
• Remove Z3-specific build setup from the governance interceptor smoke script.
• Start a dedicated smoke gateway with isolated ports, state, gateway ID, and scrubbed ambient OpenShell environment.
• Print neutral setup INFO messages and reserve PASS/FAIL for functional checks.
• Dump smoke, gateway, and interceptor logs inline on failures.
• Refresh the governance interceptor README smoke-test wording.

Testing

• CC=clang CXX=clang++ mise run pre-commit passes
• OPENSHELL_GOVERNANCE_KEEP_LOGS=1 examples/governance-interceptor/smoke.sh passes
• Hostile ambient OpenShell env smoke run passes
• Unit tests added/updated (not needed for smoke script hardening)
• E2E tests added/updated (not applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2005.docs.buildwithfern.com/openshell