feat: add HOL Guard tool

[kantorcodes]

Summary

Adds HOL Guard as a standalone Trunk tool backed by the stable hol-guard PyPI package.

• exposes the hol-guard shim through Trunk's default plugin source
• pins the validated known_good_version to 3.0.166
• adds a hol-guard --version semver health check
• adds the repository-native toolInstallTest

This follows the current tools/ contribution pattern for Python runtime packages. HOL Guard v3.0.166 is the validated release used by this contribution.

Validation

• manifest/test structure mirrors existing Trunk Python tools and hyphenated tool naming
• plugin.yaml and toolInstallTest both pin 3.0.166
• the earlier merge-queue macOS failure was on 3.0.18, where a base LiteLLM dependency fell back to a Rust build under Python 3.14; 3.0.166 no longer includes LiteLLM/Cisco scanner in its base dependencies

I could not run the full local trunk check in the connected execution environment, so I am not claiming that as passed; the repository-native install test is included for CI.

Affiliation: I maintain HOL Guard / Hashgraph Online. AI assistance was used to prepare this focused contribution and the release refresh.

[trunk-io]

😎 Merged successfully - details.

[kantorcodes]

/trunk merge

[kantorcodes]

/trunk merge

[trunk-io]

An error occurred while submitting your PR to the queue: Only users that are a part of this repo's Trunk organization or have write permissions to the repo can submit a PR to the queue

[kantorcodes]

All required changes are in and the PR is still mergeable. The queue command now reports that only a repo member or someone with write access can submit it. Could a maintainer add #1163 to the merge queue when convenient? I’ll handle any requested changes right away.

[EliSchleifer]

LGTM. Thanks

[kantorcodes]

The prior merge-queue failure was the macOS job installing 3.0.18: litellm fell back to a Rust build under Python 3.14 and the runner had no cc. The current branch pins 3.0.166, which no longer pulls cisco-ai-skill-scanner / litellm as base dependencies, so that specific failure should be gone. If you can requeue this head, I can handle anything else that surfaces.