fix: exempt runtime-generated tweaks from the deployment policy (#14695)

* fix: exempt runtime-generated tweaks from the deployment policy

Addresses review findings I1, I2 and I3.

I2: tweaks are also how the runtime passes values into a sub-flow. The Run
Flow component and the flow runner build their own, so judging those against
the policy made 'off' disable flow-as-tool orchestration instead of closing
an API surface. They now resolve to permissive, the same reasoning that
exempts the injected 'stream' key. The protected-field floor still applies.

I1: the advanced-run route was a third process_tweaks call site whose broad
except turned a refusal into a 500.

I3: both appliers now delegate to _refused_tweak_names instead of re-deriving
the floor and policy inline, so the security predicate has one implementation.

* fix: exempt the flow-as-tool path from the deployment policy too

The graph-path exemption covered RunFlowBaseComponent, which passes a prebuilt
graph. An agent calling a flow as a tool takes a different route: the generated
flow_function builds tweaks from the tool's declared arguments and hands them to
load_flow, which reached process_tweaks with caller_supplied defaulting to True.
CustomComponent.run_flow shares that route. Under 'off' both were still refused.

No API route reaches this helper, so exempting it does not widen the caller
surface. The protected-field floor still applies.

* docs: say what off does to MCP tool calls

MCP builds tweaks from tool inputs and sends them through the caller-facing run
API, so the policy judges them. Under off an MCP tool call cannot pass inputs at
all. That follows from MCP being an external caller, but an operator reading the
runtime exemption above could reasonably assume it covered MCP too.

* docs: clarify MCP tweak policy behavior

---------

Co-authored-by: Eric Hare <ericrhare@gmail.com>