Fix/sync tool gate bypass

[yanny-sec]

Summary

sync_gate failed open while the WS handshake was incomplete: it read "policy not established yet" as "nothing to gate" and returned False, so the tool ran. The fix removes that premature check and defers the decision to _async_gate, which waits for the handshake before deciding. The only remaining fail-open is ws is None, e.g. the SDK is not running at all. The trade-off is that a handshake which never completes now blocks rather than passes.

Closes #91

Test plan

• Tested against @gladstomych-sa's usecase

Checklist

• CLA signed (see CLA.md)
• Tests pass locally
• Docs updated where needed
• British English; no em-dashes; no marketing fluff

[gladstomych-sa]

LGTM