fix(google_adk): move the four tool-scoped rules into the 0NN block

[sairenchristianbuerano]

These four shipped with scope: tool while sitting in the 1NN block, which the README documents as agent or subagent scope. Every other ADK rule obeys the split — 001–016 are tool scope, 101–112 are agent scope.

@jhumel-code asked for exactly this on trustabl/agent-reliability-rules#96 before it landed, and named ADK-014 as the replacement:

The README documents the ID blocks as NNN tool scope, 1NN agent or subagent scope, 2NN repo scope... IDs are permanent once shipped, so this is much cheaper now. Your other tool-scoped ADK PRs have the same issue and I will follow up there.

The merge went in ahead of the change. This closes it while the ids are still free.

was	now	rule
ADK-117	ADK-014	TypeScript FunctionTool writes to the filesystem
ADK-114	ADK-017	TypeScript FunctionTool HTTP call has no timeout
ADK-115	ADK-018	FunctionTool description is a placeholder
ADK-116	ADK-019	FunctionTool description is too short

014, 017, 018 and 019 were the free ids in the 0NN block. Rule text, severity, confidence and match expressions are unchanged — only the id.

Verified

• no duplicate rule ids
• every ADK id now matches its block, with one documented exception: ADK-008 is agent scope in the 0NN block, predates this, and the README names it explicitly — left alone
• trustabl rules validate: 276 rules valid under schema 17
• go test ./internal/rules/ passes; all 10 renumbered cases execute and pass under the new ids
• check-rules-sync.sh: in sync, 109 files compared

Merge back to back with trustabl/agent-reliability-rules#154. Either half alone renames a rule on one side only and turns rules-sync red.