Guard an agent's tool call arguments

An operations agent can call a restart_service tool. Model output is not trusted, so a guard checks the arguments of every call before the tool sees them. The tool's schema maps each parameter name to {"type": "str" | "int" | "bool", "required": bool}, and an "int" parameter may also carry a "max".

Write check_args(schema, args). Return "ok", or the first problem as "<kind>:<name>". Check the kinds in this order, and if one kind has several offenders, report the name that sorts first in plain string order (by character code, so uppercase before lowercase):

1. "unknown:<name>": an argument that is not in the schema, even one whose value is None. Models invent parameters, and the guard must not pass them along.
2. "missing:<name>": a required parameter that is absent. An argument whose value is None (null) counts as absent.
3. "type:<name>": a value of the wrong type. "str" means a string; "bool" means true or false; "int" means a whole number and never a boolean. (In Python, bool is a subclass of int, so isinstance(True, int) is True: check for it.)
4. "limit:<name>": an int below 0, or above its "max" when it has one. The max is inclusive.

Names are case-sensitive. An optional parameter that is absent (or None) is fine.

Examples, with this schema:

{
  "service":  { "type": "str",  "required": true },
  "replicas": { "type": "int",  "required": false, "max": 10 },
  "force":    { "type": "bool", "required": false }
}

• check_args(schema, {"service": "api", "replicas": 3}) returns "ok".
• check_args(schema, {"service": "api", "replicas": 12, "region": "eu"}) returns "unknown:region": unknown arguments are reported before the limit problem.
• check_args(schema, {"service": "api", "replicas": True}) returns "type:replicas".