Add optional Rich CLI + tool-protection decorator

[Sunny-commit]

Implements the first DX milestone:

• Adds an opendecision CLI (opendecision evaluate ...) that loads a decision-pack YAML policy, evaluates provided JSON state via DecisionGuard, and renders decision/confidence/probabilities/provider.
• Uses Rich tables automatically when opendecision[rich] is installed (otherwise prints plain text). Rich remains optional.
• Adds a raw-Python protect_tool(...) decorator with fail-closed behavior (allow executes; review -> ToolReviewRequiredError; else -> ToolBlockedError).
• Fixes DecisionGuard to lazily import the Laya provider (so importing opendecision does not require laya).
• Updates packaging (project.scripts, optional dependency group) and README.
• Adds unit tests (tests/test_cli.py, tests/test_tool_guard.py) that use a fake provider and do not download models.

Closes #10.