Integrate Arcjet Guard into Python LangChain

arcjet.guard.langchain wraps the agent's existing Arcjet client. It never talks to the Arcjet API itself. Shared Guard fundamentals (client, rules, labels, decisions, capture, registration) live in ../arcjet/references/guards_python.md. Load that reference for anything that is not LangChain-specific.

Four surfaces, one decision rule:

• Any Python callable → guard_action / guard_action_sync in core arcjet.guard. No LangChain extra. Details in the shared Python Guard reference.
• A LangChain BaseTool you call yourself → guard_tool. DENY raises ArcjetToolDeniedError (the tool's handle_tool_error may convert it).
• create_agent (the model chooses tools) → ArcjetMiddleware + ToolPolicy. Tools without a policy pass through.
• Observe a chain or agent → ArcjetCaptureHandler / ArcjetAsyncCaptureHandler. These cannot deny.