How does the inline reference monitor handle tool calls that are dynamically composed by the coding agent, and what evidence do you expose when a call is blocked or rewritten?