fix(engine): add real packages/loopover-engine paths to ENGINE_DECISION_GUARDRAIL_GLOBS

[JSONbored]

Summary

• Closes ENGINE_DECISION_GUARDRAIL_GLOBS still protects the pre-migration src/ shim paths, not the real packages/loopover-engine files where the guardrail logic now lives #8012
• src/settings/autonomy.ts and src/review/guardrail-config.ts are now 5-line chore(review): converge 9 hand-duplicated src/review/ files onto their @loopover/engine shims #6203 re-export shims — the real, substantive logic lives at the corresponding packages/loopover-engine paths instead. Neither real path was listed in ENGINE_DECISION_GUARDRAIL_GLOBS, so a PR editing the autonomy deny-by-default dial, or editing ENGINE_DECISION_GUARDRAIL_GLOBS/DEFAULT_HARD_GUARDRAIL_GLOBS itself to quietly remove entries, touched only the real engine-package file and never tripped the guardrail hold it should have.
• Every other exact-file entry in this list was checked against the current checkout and confirmed to still be a real, substantial file, not a shim — this was an isolated gap from the chore(review): converge 9 hand-duplicated src/review/ files onto their @loopover/engine shims #6203 migration, not a symptom that every entry needs updating.

Validation

• npm run typecheck — clean.
• npx vitest run test/unit/guardrail-config.test.ts test/unit/change-guardrail.test.ts — 29/29 passing, including two new cases: both real engine-package paths are classified as guardrail-protected via isGuardrailHit/DEFAULT_HARD_GUARDRAIL_GLOBS (not just present in the array — actually exercised through the real matching function), and both pre-migration shim paths still guard too (additive, neither replaces the other).
• Rebuilt packages/loopover-engine (npm run build) before testing, since src/review/guardrail-config.ts re-exports the compiled engine dist output.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	loopover-ui	d28d3aa	Commit Preview URL Branch Preview URL	Jul 23 2026, 12:01 AM

[JSONbored]

Closing — #8128 merged the identical fix (same two real packages/loopover-engine paths added to ENGINE_DECISION_GUARDRAIL_GLOBS, equivalent test coverage) before this one landed. #8012 is already closed by that PR. Nothing here is additive over what's on main now.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.02%. Comparing base (c02a277) to head (d28d3aa).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8133      +/-   ##
==========================================
- Coverage   92.02%   92.02%   -0.01%     
==========================================
  Files         760      760              
  Lines       77394    77394              
  Branches    23392    23391       -1     
==========================================
- Hits        71225    71221       -4     
  Misses       5061     5061              
- Partials     1108     1112       +4     

Flag	Coverage Δ
shard-1	57.10% <ø> (ø)
shard-2	54.34% <ø> (ø)
shard-3	50.28% <ø> (-0.04%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...ges/loopover-engine/src/review/guardrail-config.ts	100.00% <ø> (ø)

... and 1 file with indirect coverage changes