feat(model_armor): screen tool output in ModelArmorPlugin (or companion plugin)

[saurabh4269]

Is your feature request related to a specific problem?

Same problem as #6964: the documented limitation that tool output is not screened by ModelArmorPlugin. For agents that load untrusted text through tools, screening only user prompts and model output leaves a documented security gap.

https://github.com/google/adk-python/blob/main/docs/guides/integrations/model_armor/index.md#limitations

Describe the Solution You'd Like

One of (maintainer choice):

1. Extend ModelArmorConfig with e.g. screen_tool_output: bool = False and implement screening in ModelArmorPlugin.after_tool_callback, reusing the prompt template; or
2. Ship ToolOutputModelArmorPlugin in google.adk.integrations.model_armor as an optional companion with shared config/client.

Either approach should mirror fail-closed semantics of the existing plugin and include unit tests in tests/unittests/integrations/model_armor/.

Impact on your work

Production agent pipelines where tool output is the dominant untrusted input channel. Reference sample implementation: #6964 / #6965.

Willingness to contribute

Yes. Sample PR #6965 is open; happy to contribute a core plugin PR after design alignment.

Describe Alternatives You've Considered

• Document-only workaround: insufficient; limitation is already documented but not addressed.
• Per-app custom plugins forever: duplicates logic across every ADK 2.8 adopter with tool-heavy threat models.

Proposed API / Implementation

@dataclass
class ModelArmorConfig:
    ...
    screen_tool_output: bool = False
    tool_output_blocked_message: str = "Tool output was blocked by Model Armor."

async def after_tool_callback(self, *, tool, tool_args, tool_context, result, **kwargs):
    if not self._config.screen_tool_output:
        return None
    ...

Additional context

• Not requesting Workflow-as-sub-agent (SequentialAgent deprecated but replacement (Workflow) cannot fill its role as sub_agent #5872 closed; Workflow-as-Tool is the supported orchestration path).
• Separate from Add around-call plugin hooks for durable model/tool execution #6224 (durable execution hooks).

[sanketpatil06]

Hi @saurabh4269 , Thank you for your feature request. It is currently under review, and we will let you know if we need any further information. We appreciate your understanding.