Integrate Arcjet Guard into Cloudflare Think

@arcjet/guard/cloudflare-think/v0 wraps the agent's existing Arcjet client. It never talks to the Arcjet API itself. Shared Guard fundamentals (client, rules, labels, decisions, capture, registration) live in ../arcjet/references/guards_javascript.md. Load that reference for anything that is not Think-specific.

Official @cloudflare/think >=0.3.0 <1 only — that is the first release whose beforeToolCall returns a functional ToolCallDecision (allow / block / substitute) and wraps every server-side tool's execute so the hook runs first. There is no /v1 until Think ships 1.x. This is not the Vercel AI SDK (ai / @arcjet/guard/vercel-ai/v7). Think owns streamText internally; do not also wrap its tools with the AI SDK mix-in. Not TanStack Start HTTP protect(). Not Cloudflare Workers HTTP protect() (@arcjet/node / request-based).