integrate-arcjet-guard-claude-managed-agents-pylisted

# Integrate Arcjet Guard into Python Claude Managed Agents `arcjet.guard.claude_managed_agents` wraps the agent's existing Arcjet client. It never talks to the Arcjet API itself. Shared Guard fundamentals (client, rules, labels, decisions, capture, registration) live in [../arcjet/references/guards_python.md](../arcjet/references/guards_python.md). Load that reference for anything that is not Claude Managed Agents-specific. Official `anthropic>=0.92.0,<2` only — not `claude-agent-sdk`, not `arcjet.guard.claude_agent_sdk`, not the JS `@anthropic-ai/claude-agent-sdk` adapter, and not JS Claude Managed Agents (`@arcjet/guard/claude-managed-agents/v0`, docs https://docs.arcjet.com/guards/claude-managed-agents/). Importing `arcjet.guard.claude_managed_agents` does not load Claude Agent SDK, LangChain, or CrewAI. The extra is safe (no chromadb). This is the hosted Claude Managed Agents harness (`client.beta.sessions`). Anthropic runs the agent loop and the built-in toolset (`bash`, files, web_*). The agent toolset defaults to `always_allow`, so there is **no customer pre-exec** for bash/files — `agent.tool_use` / `agent.tool_result` fire after the built-in already ran. There is no `PreToolUse`. Do not paper over that gap with `always_ask`. It is not Claude Agent SDK local `query()` / `guard_hooks`. Exports: `guard_custom_tool`, `guard_events`, `claude_managed_agents_context`. There is no `guard_inbound`, no `guard_tool`, and no `guard_tool_confirmation`. Three surfaces, one de