Function createFocusFirewall

createFocusFirewall(options: FocusFirewallOptions): FocusFirewall
Create the focus-aware firewall: kehto's pure evaluate engine fed with focus the shell observed, never focus the applet claimed.

Decisions map to guard events as follows. reject emits reject; pass with action flag emits flag; prompt emits reject with reason prompt:<ruleId>. kernl treats a prompt as a denial here because the guard runs before dispatch and has no UI; the shell's consent flow prompts the user for destructive writes on its own path, not through the firewall.

Per-class rates are registered on the first observation of each applet via applyNappletRules, so the engine's rate:opclass tier applies to every applet without core having to pre-register it.
Parameters
- options: FocusFirewallOptions
  Configuration, time source and event sink.
Returns FocusFirewall
A firewall that keeps the kehto counter state for many windows.
Example
```
const firewall = createFocusFirewall({ config: createGuardConfig('strict') });
const result = firewall.observe('w1', 'chat', { type: 'relay.publish' }, { visible: true, focused: true });
result.decision; // 'pass'
```