The tool contract — make the dangerous call a validation error — step 6 of 7

Write validate_call(call) — the gate every proposed tool call passes through before anything executes. Checks run in this order, and the first failure wins:

1. call["tool"] not in TOOLS → "reject: unknown tool"
2. any name in the spec's required list missing from call["args"] → "reject: missing <field>"
3. any field in the spec's allowed dict whose arg value isn't in the allowed list → "reject: bad <field>"
4. spec has confirm: True and the call lacks a truthy confirmed → "reject: needs confirm"
5. otherwise → "ok"

Expected output:

get_failing_jobs ok
open_issue       reject: missing severity
open_issue       ok
escalate         reject: needs confirm
deploy_prod      reject: unknown tool