refactor(detection-emulation): thread savedObjectsClient into gates

Adds optional savedObjectsClient to CommandGatesContext and the factory
handler destructure. When provided by the Agent Builder handler context,
withCommandGates uses it directly for uiSettingsClient derivation rather
than re-creating a scoped client via coreStart.savedObjects.

This eliminates a redundant getScopedClient call (async hop) on every
tool invocation while keeping backward compat (falls back to
request-scoped creation when the field is absent).

Author: patrykkopycinski

x-pack/solutions/security/plugins/security_solution/server/agent_builder/skills/detection_emulation/create_run_family_command_tool.ts

@@ -88,7 +88,7 @@ export function createRunFamilyCommandTool(
     },
     handler: async (
       rawParams: z.infer<typeof schema>,
-      { esClient, spaceId, request, runContext, callContext }: any
+      { esClient, spaceId, request, runContext, callContext, savedObjectsClient }: any
     ) => {
       const { emulationId, agentType, command } = rawParams;
 
@@ -118,6 +118,7 @@ export function createRunFamilyCommandTool(
           request,
           esClient,
           spaceId,
+          savedObjectsClient,
           actorContext,
         },
         strictParseResult.data

x-pack/solutions/security/plugins/security_solution/server/agent_builder/skills/detection_emulation/with_command_gates.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import type { Logger, ElasticsearchClient, KibanaRequest } from '@kbn/core/server';
+import type { Logger, ElasticsearchClient, KibanaRequest, SavedObjectsClientContract } from '@kbn/core/server';
 import { ToolResultType } from '@kbn/agent-builder-common';
 import type { RunEmulationCommandInput } from '../../../../common/detection_emulation/schemas';
 import type { ConfigType } from '../../../config';
@@ -54,6 +54,7 @@ export interface CommandGatesContext {
   request: KibanaRequest;
   esClient: { asCurrentUser: ElasticsearchClient };
   spaceId: string;
+  savedObjectsClient?: SavedObjectsClientContract;
   actorContext?: ActorContext;
 }
 
@@ -110,6 +111,7 @@ export const withCommandGates = async (
     request,
     esClient,
     spaceId,
+    savedObjectsClient,
     actorContext,
   } = ctx;
   const { emulationId, agentType, endpointIds, command } = cmd;
@@ -162,7 +164,7 @@ export const withCommandGates = async (
 
     // ── Per-request guardrail resolution ────────────────────────────────────
     const [coreStart] = await core.getStartServices();
-    const soClient = coreStart.savedObjects.getScopedClient(request);
+    const soClient = savedObjectsClient ?? coreStart.savedObjects.getScopedClient(request);
     const uiSettingsClient = coreStart.uiSettings.asScopedToClient(soClient);
     const { effectiveAllowlist, effectiveRateLimiter } = await resolveEffectiveConfig({
       uiSettingsClient,