Policy blocks MCP server discovery and prevents authentication flow.

[sangee2004]

Reproduces Always
Describe the bug
A message policy intended to limit the number of emails listed (e.g., max 10) is incorrectly applied to tool calls made my obot_mcp_server. As a result, when a user who is not connected to the Gmail MCP server tries to list recent emails, the obot_search_mcp_servers tool call is blocked by the policy. This prevents the system from prompting the user to authenticate and connect to the Gmail MCP server, breaking the expected onboarding flow.

To Reproduce
Steps to reproduce the behavior:

1. As an admin user, create a message policy that applies to both User Messages and Tool Calls, like Do not allow more than 10 emails to be listed.

2. As any user who is not connected to Gmail MCP server, Launch Agent.
3. Start a new chat session and ask to list most recent email.
   Notice that obot_search_mcp_servers tool call gets blocked by the policy created in step 1 resulting in user not being prompted to authenticate with Gmail MCP server.

Expected behavior
Policy restricting number of emails to be listed should not block users from searching for MCP servers and connecting to it.

[sangee2004]

I have also seen other policies block MCP server discovery incorrectly.

[g-linville]

I adjusted the way the second phase of the policy evaluation works, and it should block less aggressively now.

[sangee2004]

Not able to reproduce the issue with policy blocking MCP server discovery when testing with the latest obot server build from main.