Pre-signature policy gate for outbound transactions. Evaluates allowlists, denied function selectors, and value caps before signing/broadcast.