Where Rules End and Judges Begin: Measuring the Judgment Boundary in Multi-Agent Systems Security