feat(iot): IoT 插件化（Provider/Manager/mock 8设备/能力约束/bus 事件）；feat(capability/restrict): 工具级布尔标记（群聊/陌生人可用，默认关，策略引擎雏形）+ registry ToolPolicy

internal/capability/registry/registry_test.go

@@ -246,3 +246,70 @@ func TestRegistry_ConcurrentSafety(t *testing.T) {
 func kn(w, i int) string {
 	return "cap" + strconv.Itoa(w) + "-" + strconv.Itoa(i)
 }
+
+func TestRegistry_ToolPolicyDefaultsFalse(t *testing.T) {
+	t.Parallel()
+	r := New()
+	if err := r.RegisterTool(regTool{name: "calc"}); err != nil {
+		t.Fatalf("RegisterTool: %v", err)
+	}
+	pol, err := r.Policy("calc")
+	if err != nil {
+		t.Fatalf("Policy: %v", err)
+	}
+	if pol.AllowInGroup || pol.AllowInStranger {
+		t.Fatalf("default policy = %+v, want both markers false", pol)
+	}
+}
+
+func TestRegistry_SetPolicyAndSetters(t *testing.T) {
+	t.Parallel()
+	r := New()
+	if err := r.RegisterTool(regTool{name: "calc"}); err != nil {
+		t.Fatalf("RegisterTool: %v", err)
+	}
+
+	if err := r.SetPolicy("calc", ToolPolicy{AllowInGroup: true, AllowInStranger: true}); err != nil {
+		t.Fatalf("SetPolicy: %v", err)
+	}
+	pol, _ := r.Policy("calc")
+	if !pol.AllowInGroup || !pol.AllowInStranger {
+		t.Fatalf("after SetPolicy = %+v, want both true", pol)
+	}
+
+	if err := r.SetAllowInGroup("calc", false); err != nil {
+		t.Fatalf("SetAllowInGroup: %v", err)
+	}
+	pol, _ = r.Policy("calc")
+	if pol.AllowInGroup {
+		t.Fatalf("SetAllowInGroup(false) did not clear group marker: %+v", pol)
+	}
+	if !pol.AllowInStranger {
+		t.Fatalf("SetAllowInGroup unexpectedly cleared stranger marker: %+v", pol)
+	}
+
+	if err := r.SetAllowInStranger("calc", false); err != nil {
+		t.Fatalf("SetAllowInStranger: %v", err)
+	}
+	pol, _ = r.Policy("calc")
+	if pol.AllowInGroup || pol.AllowInStranger {
+		t.Fatalf("after clearing both = %+v, want both false", pol)
+	}
+}
+
+func TestRegistry_Policy_NotFound(t *testing.T) {
+	t.Parallel()
+	r := New()
+	if _, err := r.Policy("missing"); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("Policy(missing) error = %v, want ErrNotFound", err)
+	}
+	if err := r.SetPolicy("missing", ToolPolicy{}); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("SetPolicy(missing) error = %v, want ErrNotFound", err)
+	}
+	if err := r.SetAllowInGroup("missing", true); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("SetAllowInGroup(missing) error = %v, want ErrNotFound", err)
+	}
+	if err := r.SetAllowInStranger("missing", true); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("SetAllowInStranger(missing) error = %v, want ErrNotFound", err)
+	}
+}