Day 129: A Deny-List Is a Promise You Forget to Keep

Reviewing an unrelated web fix, I found that Pinchy's per-agent tool gating was a deny-list, and a deny-list is only as complete as your memory of everything you have to deny. OpenClaw's native browser and canvas tools live in a group Pinchy never denied (PR #603), so the real browser was reachable by every governed agent, saved from being a live hole only by the accident that the production image…