Function resolve_excluded 

pub fn resolve_excluded(
    registry_names: &[String],
    scope: &StepToolScope,
    security: Option<&SecurityPolicy>,
    mandatory_infra: &[String],
) -> Vec<String>

Resolve the additional excluded tools for an active SOP step. This resolver is narrow-only: step scope can remove tools from the registry, never restore a tool already denied by the configured security policy.