integrate-arcjet-guard-cloudflare-think

# Integrate Arcjet Guard into Cloudflare Think `@arcjet/guard/cloudflare-think/v0` wraps the agent's existing Arcjet client. It never talks to the Arcjet API itself. Shared Guard fundamentals (client, rules, labels, decisions, capture, registration) live in [../arcjet/references/guards_javascript.md](../arcjet/references/guards_javascript.md). Load that reference for anything that is not Think-specific. Official `@cloudflare/think` `>=0.3.0 <1` only — that is the first release whose `beforeToolCall` returns a functional `ToolCallDecision` (`allow` / `block` / `substitute`) and wraps every server-side tool's `execute` so the hook runs first. There is no `/v1` until Think ships 1.x. This is **not** the Vercel AI SDK (`ai` / `@arcjet/guard/vercel-ai/v7`). Think owns `streamText` internally; do not also wrap its tools with the AI SDK mix-in. Not TanStack Start HTTP `protect()`. Not Cloudflare Workers HTTP `protect()` (`@arcjet/node` / request-based). Exports: `guardHooks`, `cloudflareThinkContext`. There is **no `guardTool`** and no `guardThink` mixin. Skip is the `beforeToolCall` return, not throw-from-execute. There is no `guardInbound` and no `guardApproval`. No unversioned `@arcjet/guard/cloudflare-think` alias. Two surfaces, one decision rule: - **Tool calls** → `guardHooks`. Returns a `{ beforeToolCall }` object the `Think` subclass **delegates to**. Delivery is a Think `ToolCallDecision`: **substitute** (`{ action: "substitute", output: ArcjetDenialResult }`) so...