fix: register recent tenant-firewall surfaces

[Jammy2211]

Overview

PyAutoHeart reports six tenant-firewall mismatches introduced by recent
PyAutoBrain and PyAutoHands work. These are intentional policy inventories,
test fixtures, and explanatory examples, so they should be declared in the
firewall's frozen baseline without changing organ source or weakening detection.

Plan

• Register the six intentional organ-code surfaces.
• Keep the detector and affected Brain/Hands files unchanged.
• Verify the full manifest and its negative drift behavior.
• Refresh Heart after merge.

Detailed implementation plan

Affected Repositories

• PyAutoMind (primary)

Branch Survey

Repository	Current Branch	Dirty?
PyAutoMind	main	unrelated draft plus task prompt

Suggested branch: feature/register-tenant-firewall-surfaces
Work classification: Library workflow
Worktree root: ~/Code/PyAutoLabs-wt/register-tenant-firewall-surfaces/

Implementation Steps

1. Update scripts/repos_sync.py::FIREWALL_ALLOWLIST for the two hygiene
   scanners, clean-slate script/tests, hygiene tests, and notebook runner.
2. Run python3 scripts/repos_sync.py --check.
3. Run a negative probe proving undeclared facts still fail.
4. Review, ship, merge with authorization, and refresh Heart.

Key Files

• scripts/repos_sync.py — canonical firewall baseline

Original Prompt

Click to expand starting prompt

do the next bit of work

[Jammy2211]

Shipped

• PR: fix: register recent tenant-firewall surfaces #115 (merged)
• Reviewed head: 6b2583a8a812277eedc4f2d2f84e5b41fc802c85
• Merge commit: 2a02a460f6156b5ef9a4363931dd0bbc8b6b392c
• Claude Opus 5 max-effort review: CLEAN after the sole ordering finding was remediated
• Validation: python3 scripts/repos_sync.py --check PASS; negative listed/unlisted drift probes PASS; merged scripts/repos_sync.py blob is byte-identical to the reviewed head
• Workspace impact: none; internal PyAutoMind manifest maintenance, so workspace smoke was not applicable

Post-merge Heart: YELLOW 80, now with only the two accepted standing gaps:

1. workspace validation not passing (13 failed, 2026-07-21T19-05-22Z)
2. 33 stale parked script(s)

The tenant-firewall manifest reason is cleared: manifest_drift identity in sync (10 surfaces vs repos.yaml).

Completion is recorded at complete/2026/07/register-tenant-firewall-surfaces.md; task worktree and local/remote feature branches were removed. Issue intentionally left open pending explicit close authorization.

[Jammy2211]

Shipped via PyAutoMind#115 (merged 2026-07-29); record complete/2026/07/register-tenant-firewall-surfaces.md. Closing on 2026-07-30 human cleanup authorization.