cross-review

No evidence of malware, credential theft, network exfiltration, persistence, destructive behavior, or obfuscated payloads exists in this fragment. The reviewer guard and conservative diff handling are security-oriented, but the pre-push/plan/audit workflows mostly emit instructions rather than executing or validating reviews, and they exit successfully. This creates a significant process-integrity risk: a caller may believe a review gate ran when only status messages were printed. The delegated mutation and round scripts should be reviewed separately, especially because the mutation test interface may execute a supplied command.