AIR Trust Layer for Google ADK — PII tokenization, audit trails, injection detection, and policy enforcement