[jothimani-rajendran]

What

Hardening of the engine's path handling, turn-end worktree read, person-only command check and guardrails toggle lookup (plan item SR-3 in org-plan plan/internal-release.md).

• cli: --check opens a person-only command only where its parser defines the flag (sync, recompile), and only before --.
• gate: a write of empty content and an apply_patch delete or move are judged by path; the turn-end listing names deleted files and a rename's old name; a path gate also covers the policy's own compiled and source folders (content scans still skip them).
• gate: plugin gates judge from the repository top level; the turn-end read of the worktree no longer opens link targets, FIFOs or devices and refuses what it cannot read safely; on-disk case is judged on case-insensitive platforms.
• gateway: judges the same folded, resolved and cased spellings as write_gate.repo_paths; a scoped gate treats a path it cannot place in the repository as in scope.
• guardrails: in a repository a member is off only where HEAD's .chock/guardrails.json says so; the shell guard refuses a write through a path built by expansion.
• New small modules gate/repo_names.py, gate/worktree_read.py, chock_guardrails_protect/names.py keep files under the 300-line budget.

Definition of done

• ruff check and ruff format --check clean
• pytest (full suite, -n 4, tests/test_properties.py excluded: needs hypothesis, unmeasured) green except the two freshness tests below
• chock sync --repo . --check clean: needs the owner's chock sync to re-render .chock/bin (owner-only). Expected red until then: test_vendored_gate_py_matches_source, test_this_repo_has_compiled_what_it_declares
• changelog.d/engine-hardening-round-2.md added
• Runtime goldens regenerated (CHOCK_REGEN_GOLDENS=1)

Claims

No new surface is installed or described as enforcing more than before.