config audit

The Line I Thought Matched Nothing Was Approving Everything: Auditing Empty Allowlist Entries

Allowlist entries that decompose to zero command words matched every command and silently auto-approved it. Here is how I scanned my own config, separated the hole the fix closed from the one it did not, and rewrote matching to a prefix-token comparison.