gemini-cli - 💡(How to fix) Fix Custom External Safety Checkers

What would you like to be added?

Currently, the CheckerRegistry only supports built-in checkers (allowed-path and conseca). This feature allows users to:

1. Register custom external safety checker executables programmatically via Config.customSafetyCheckers.
2. Define custom checker paths directly in TOML policy rules using a new path field.
3. Integrate organization specific security policies and compliance checks into the CLI's safety system. This completes the "Phase 5" TODO item in packages/core/src/safety/registry.ts.

Why is this needed?

Organizations and power users need to enforce custom security policies, compliance checks, and validation logic that go beyond the built-in allowed-path and conseca checkers. Currently, the safety system is closed to extension. This feature enables:

• Custom security validation: Teams can integrate their own security tools (e.g., custom path validation, secret scanning, audit logging) into the CLI's safety pipeline.
• Compliance enforcement: Organizations can implement checkers that validate tool calls against internal compliance requirements or regulatory standards.
• Extensibility: The safety system becomes pluggable, allowing the community to build and share custom checkers for specific use cases.

Additional context

No response