Prompts told agents internal API calls were denied; the guard only denied GitHub. Combined with task 4 (X-Agent-Role enforcement) this closes the manifest-bypass loophole.
