agentflow

No clear malicious payload or explicit data exfiltration is present. This is a live-agent integration test that deliberately runs Claude with permission checks bypassed, so it should only be run in an appropriately isolated environment with `--run` supplied intentionally.