estimate_workflow_fanout — F7 scriptPath allowlist / F8 wrapper-alias broadening (accepted residue from #20)

[kiki830621]

Context

Accepted residue from #20 (estimate_workflow_fanout accuracy). During #20 these two were deliberately not done (recommendation: accept), and #20's #19-verify + implementation cited them. This is the correct tracking issue (the earlier #20 commit/CHANGELOG mistakenly cited #21, which is the fable-gate follow-up of #18 — unrelated).

Deferred findings

• F7 (LOW) — scriptPath unrestricted local file read, no allowlist. estimate_workflow_fanout reads any user-readable regular file named in tool_input.scriptPath. Accepted because: scriptPath comes from the assistant's own Workflow tool call (same trust boundary the Workflow runtime uses), the read is 200KB-bounded, content is only regex-counted and never echoed/eval'd, and exceptions fail-open. A path allowlist would break legit temp/session scriptPaths (which live in varying dirs) → fail-open would then silently drop the advisory. pacing-guard.py scriptPath branch. Revisit only if a concrete threat emerges.
• F8 (LOW) — exact agent( token misses wrappers/aliases beyond sub_agent(. estimate_workflow_fanout heuristic accuracy — F4–F9 (6-AI verify follow-up of #19) #20 added sub_agent( (the one concrete case pacing-guard 顯示 Workflow fan-out agent 數 + 依數量建議 opus/sonnet dispatch（sibling of #18） #19 reviewers named). dispatchAgent(, agent?.(, const a = agent; a(...) remain uncounted. NOT broadened to arbitrary \w*agent( because that mis-counts myagent( etc. (false positives). Accepted; revisit if real-world under-reporting shows up.

Not blocking

Both are LOW, advisory-only (the #19 fan-out nudge is display-only + fail-open). Filed for traceability, not urgency.