[jothimani-rajendran]

Batch branch for the remaining runtime-touching hardening. Each item lands as its own commit(s); the owner syncs the compiled runtime and goldens once at the end of the batch.

Items

• SR-4e: the rendered runtime is independent of the Python patch release. ast.unparse on 3.12.0 to 3.12.x writes same-quote nested f-strings that are a SyntaxError on 3.11; the renderer now lowers any f-string holding a string literal to ''.join([...]), so the output is byte-identical and parses on 3.11 on every interpreter. Adds tests/test_runtime_render_portable.py.
• SR-4f: toggle trust (hardening). An off in .chock/guardrails.json or ~/.chock/guardrails.json is honoured only by a session that started after that file's record last changed. A merged plugin binds each session, by the session log's id, to the toggle files and records it first sees; if one changes during the session every member stays on until the next session. The session-start hook binds the session and lists every member that is off, by scope. The Stop-time check refuses a turn's end while a file changed during the session switches a member off. The built-in protection (never toggleable) also refuses an agent's shell or Edit/Write change to a session's binding file. The docs state that a toggle is not a security boundary against an agent running as the person; interactive confirmation is a later item. No new secret or key. Adds toggle_state.py (shipped beside the wrapper) and tests for the binding, the turn-end check and the protected binding file.
• SR-8a: path hardening. On macOS and Windows, where the filesystem ignores letter case, the write gate, the MCP gateway's path check and the outside-repository globs now match forbidden-path patterns and scope globs without regard to case, in addition to the on-disk spelling. A case_blind override (stdin key to the runner, keyword on evaluate_gate, judged_files and the gateway's judge/evaluate) makes it testable on any platform; the default is the platform's. The bash probe in guard_runner.find_bash now receives the guard path as an argument instead of building it into the shell string. Adds tests/test_case_blind_gates.py and a probe test in tests/test_bash_discovery.py, plus two changelog fragments. Worked against v1-runtime as it stands: gate/repo_names.py (SR-3) is not on this branch and arrives at rc.3, so this item does not use it.

More items will be added here.

Expected CI state

Compiled drift and runtime goldens (including the plugin-target goldens, which now list the session-start wrapper and the new shipped module) are red until the single sync; no goldens or .chock/ files are committed here. SR-8a also changes the runner, so tests/test_runner_selfcontained.py::test_vendored_gate_py_matches_source joins them until the sync.