Runs before_action guards right before an action capability is invoked.

Guards are the host-state veto point of the action lifecycle: routing has already selected the handler, planning has already staged the effect, and any protecting policy has already been satisfied. A guard can still stop execution because of state only the application can see — an open draft, a role restriction, a quota — and turn the pending effect into a plain reply instead of a capability call.

A guard callback receives (action, ctx) and returns:

• :allow (or :ok) — execution proceeds
• {:suppress, reply_text} — the pending effect is cancelled without invoking the capability; the turn resolves as a reply with that text
• {:error, reason} — execution fails closed

Guards apply to :action effects only and run in declaration order; the first non-:allow outcome wins.