A Tool Gateway Can Hold the Keys Without Giving Them to Agents

[article, ai, mcp, agent-tools, infrastructure, security, tool-policy, joelclaw] Executor's shared catalog and allow/approve/block boundary could replace duplicated tool wiring across joelclaw's Pi, Claude Code, and Codex clients.