Microsoft Agent Governance Toolkit linter accepts rules that never fire

The agt lint-policy linter passed deny rules that can never match any event, and the evaluator silently applied its default action. Maintainers audited the issue, found more failure modes and plan fixes in the 5.2.0 migrator, but published 4.x packages will stay unpatched.

• A toolname typo for tool_name and an empty in: [] both passed the linter with "No issues found"
• Under default_action: allow such rules silently permitted actions instead of blocking them
• Fixes ship in the agt-policies 5.2.0 migrator; packages 4.1.0 and 3.7.0 will not be patched
• Maintainers will add a LIMITATIONS entry and switch the quickstart to default_action: deny