integrations: add Attenu Guard plugin (per-agent permissions on tool calls and transfers)

[rafaelasor]

Adds docs/integrations/attenu-guard.md (+ catalog icon) for the Attenu Guard ADK plugin (Apache-2.0, PyPI attenu-guard, extra attenu-guard[google-adk]).

The plugin is one BasePlugin (attenu_guard.adapters.google_adk): before_agent_callback computes each sub-agent's permission set as the meet of the parent's and the declared child set when control reaches it (covers transfer_to_agent, AgentTool and task-mode sub-agents), and before_tool_callback checks each tool call before the tool body runs. Decisions land in a hash-chained audit log verified offline. Tested against google-adk 2.7.1; the repo ships a scripted-model example (no API key) and a live smoke test.

Follows the plugin-page conventions (frontmatter, language tag, Use cases, Prerequisites, Installation, Use with agent, Resources). Disclosure: I maintain attenu-guard. I have signed / will sign the Google CLA on this PR.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[rafaelasor]

@googlebot I signed it!

[rafaelasor]

Rebased onto main on 09-01 and re-checked the entry against the integration-review checklist. CLA is signed and checks are green. Is there anything else you need from me before a review?

[rafaelasor]

@joefernandez Could you triage this one? It has had no label since it opened on 2026-08-26. It adds one page under docs/integrations/ plus its screenshot, for an ADK plugin that narrows what a sub-agent may do at each transfer and checks every tool call before the body runs. integration looks like the right label.