Guardrails turn off and on; a judge's refusal says which hazard; ctl guard judge ask

guard.enabled (unset is on) makes every policy check nothing while false,
live: llmgw ctl guard off/on set it in the cluster's settings, and ctl
status, ctl guard list and the guardrails page say when they are off.

A refusal by a judge names the hazard it saw - judge: S6,Specialized
Advice - and the verdict is kept with the request in a new usage column,
guard_rule, shown by ctl request, the request log and the guardrails page.

llmgw ctl guard judge ask has a judge read a text, past the cache, and shows
its raw answer and how it is read; the endpoint is kept out of the audit so
no text is recorded.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/reference.md

@@ -372,6 +372,7 @@ rather than repeated.
 | `llamacpp` | `LlamaCppConfig` | [engines.Config](#enginesconfig) |
 | `trtllm` | `TRTLLMConfig` | [engines.Config](#enginesconfig) |
 | `sim` | `SimConfig` | [engines.Config](#enginesconfig) |
+| `enabled` | `*bool` | [guard.Config](#guardconfig) |
 | `default` | `[]string` | [guard.Config](#guardconfig) |
 | `policies` | `map[string]Policy` | [guard.Config](#guardconfig) |
 | `webhooks` | `[]Webhook` | [notify.Config](#notifyconfig) |
@@ -3067,6 +3068,13 @@ Takes a [SimConfig](#simconfig) block.
 
 ## guard.Config
 
+### `enabled`
+
+`*bool`
+
+Enabled turns every policy on or off at once: false checks nothing,
+whatever is defined or attached. Unset is on.
+
 ### `default`
 
 `[]string`