Guards

Denies a delegated agent lane any write to this repo's Claude settings files.

Report model drift and deny only positively invalid stale-pin launches.