feat(trace): isolate chat runs

src/test/java/com/superbiz/agent/service/ExecutorGatekeeperServiceTest.java

@@ -11,10 +11,29 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 class ExecutorGatekeeperServiceTest {
 
+    @Test
+    void validateRunUsesRunScopedToolRows() {
+        ToolInvocationRepository repository = mock(ToolInvocationRepository.class);
+        when(repository.findByRunIdOrderByIdAsc("run-gatekeeper-1")).thenReturn(List.of(
+                invocation(101L, "query_metrics", "$.alerts[0]",
+                        "HighCPUUsage firing, service=payment-service, current=92%")
+        ));
+        ExecutorGatekeeperService service = new ExecutorGatekeeperService(repository);
+
+        Map<String, Object> result = service.validateRun("run-gatekeeper-1",
+                validOutput(101L, "query_metrics", "$.alerts[0]",
+                        "HighCPUUsage firing, service=payment-service, current=92%"),
+                Map.of("status", "valid"));
+
+        assertEquals("pass", result.get("status"));
+        verify(repository).findByRunIdOrderByIdAsc("run-gatekeeper-1");
+    }
+
     @Test
     void ruleCatalogLoadsDefaultMetadata() {
         GatekeeperRuleCatalog catalog = GatekeeperRuleCatalog.loadDefault(new com.fasterxml.jackson.databind.ObjectMapper());