feat(samples): add SidClaw governance middleware sample

[VladUZH]

Summary

Adds contributing/samples/sidclaw_governance_agent/ — a sample showing how to wrap ADK tools with SidClaw governance middleware.

Closes #5080

What this adds:

• Policy evaluation before each tool call (allow / deny / approval_required)
• Human approval workflow: reviewer sees agent identity, tool payload, and agent reasoning before deciding
• Hash-chain audit trail for every tool execution (tamper-evident, exportable for FINRA/EU AI Act compliance)

The integration uses govern_google_adk_tools() from the SidClaw Python SDK (pip install sidclaw). It follows the same duck-typing pattern as the existing LangChain and CrewAI samples — wraps the callable without modifying the ADK agent.

Files changed

contributing/samples/sidclaw_governance_agent/
  __init__.py       # Google LLC license header
  agent.py          # Customer support agent with 3 governed tools
  requirements.txt  # sidclaw>=0.1.2
  README.md         # Setup, usage, and governance config reference

How it follows existing sample patterns

langchain_structured_tool_agent and crewai_tool_kwargs both demonstrate third-party tool ecosystem integrations. This sample does the same: uses a third-party library to add a capability (governance) to ADK tool execution.

Testing plan

Manual test:

1. pip install sidclaw google-adk
2. Set SIDCLAW_API_KEY (free tier at app.sidclaw.com — no credit card)
3. adk run contributing/samples/sidclaw_governance_agent
4. Ask the agent to "look up order ORD-123" → lookup_order executes immediately (classified internal)
5. Ask "send a follow-up email to the customer" → send_email is held for approval (classified confidential) until reviewed at app.sidclaw.com
6. Approve or deny from the dashboard — agent proceeds or raises ActionDeniedError

Unit test approach (happy to add if maintainers prefer):

• Mock SidClaw.evaluate() to return an allow decision
• Verify govern_google_adk_tools() returns a list of the same length
• Verify the governed callable has .name and .description preserved
• Verify ActionDeniedError is raised on a mocked deny response

I'll add tests/unittests/ coverage if the maintainers confirm this sample is in scope.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[adk-bot]

Response from ADK Triaging Agent

Hello @VladUZH, thank you for your contribution!

Before we can review your pull request, you'll need to sign the Contributor License Agreement (CLA). It looks like the CLA check has failed. You can view the details and sign the CLA here: https://cla.developers.google.com/

Thanks!