fix(policies): detect and wrap legacy (content, phase) callables in resolve_function_policy

[aarushisingh04]

Summary

closes Gap 7 from tests/e2e/omnigent/TODO_omnigent_coverage.md : legacy omnigent (content, phase) policy callables silently no-oping under resolve_function_policy.

• resolve_function_policy now detects legacy omnigent-style (content, phase) callables by inspecting the first two positional parameter names, and wraps them via the existing _omnigent_legacy_shim._wrap_legacy before storing them in FunctionPolicy. without this, any callable with that signature would silently ALLOW every event, the phase == "tool_call" check always fails when phase receives an event dict instead of a string.
• the import is deferred inside the function (not module-level) to break a circular init chain: function.py → _omnigent_legacy_shim → policies.types → policies.__init__ → function.py.
• modern single-arg (event) callables are unaffected; the adapter path (handler: → _translate_function_policy_yaml → shim factory) is also unaffected and does not double-wrap.

Type of change

• Bug fix
• Feature
• Refactor / chore
• Docs
• Test / CI
• Breaking change

Test coverage

• Unit tests added / updated
• Integration tests added / updated
• E2E tests added / updated
• Manual verification completed
• Existing tests cover this change
• Not applicable

Coverage rationale

three unit tests appended to tests/runtime/policies/test_function_policy.py under the Gap 7 section:

• test_resolve_function_policy_wraps_legacy_callable : asserts that resolve_function_policy with a (content, phase) callable produces a FunctionPolicy (detection and wrapping succeed at build time).
• test_resolve_function_policy_legacy_callable_evaluates_correctly : asserts the wrapped callable returns the correct DENY action and reason at evaluation time, verifying the full shim path including _coerce_legacy_return.
• test_resolve_function_policy_modern_callable_not_wrapped : asserts a modern (event) callable passes through unchanged, confirmed by checking policy._callable.__name__ == "modern_allow" (shim inners are named _sync_shim/_async_shim).

no E2E coverage added: the omnigent example callables (block_long_sleep, etc.) were already rewritten to the modern single-arg format before this PR, so no existing e2e fixture exercises a legacy callable via resolve_function_policy. the unit tests above are the only coverage of this path. E2E verification would require introducing a legacy-signature callable into an example YAML, which is out of scope for this fix.

[aarushisingh04]

note for reviewers:

if this fix looks correct, tests/e2e/omnigent/TODO_omnigent_coverage.md should be updated to move Gap 7 from "Outstanding gaps" to "Fixed". the fixed-section entry would note that resolve_function_policy now detects and wraps legacy (content, phase) callables via _omnigent_legacy_shim, and that the motivating example callables were already rewritten to modern format before this landed.

i can add the above modification to this PR if approved.

[PattaraS]

LGTM thanks for the PR!

[aarushisingh04]

note for reviewers:

if this fix looks correct, tests/e2e/omnigent/TODO_omnigent_coverage.md should be updated to move Gap 7 from "Outstanding gaps" to "Fixed". the fixed-section entry would note that resolve_function_policy now detects and wraps legacy (content, phase) callables via _omnigent_legacy_shim, and that the motivating example callables were already rewritten to modern format before this landed.

i can add the above modification to this PR if approved.

@PattaraS thanks for the review! i would like to mention this again. what would you suggest?

[PattaraS]

@aarushisingh04 That makes sense to me! Thanks for the note, we can mark the gap as fixed :)

[aarushisingh04]

@PattaraS great! i have added the updated status in the docs for gap 7, would appreciate a final review!

[PattaraS]

LGTM. Thanks again for the contribution!

[PattaraS]

/merge

[github-actions]

🤖 /merge from @PattaraS, auto-merge enabled (squash, delete branch). ✅ gate is green, merging now.