## Risk addressed

Describe the workflow failure or false positive this change addresses.

## Evidence

- [ ] Added or updated a minimal unsafe fixture.
- [ ] Added a safe fixture or regression test.
- [ ] `npm run verify` passes.
- [ ] No credentials or customer data are included.
- [ ] Policy and Codex documentation match the implementation.