guardrails 2.x: shell cd into the runtime and case-variant paths reach plugin-owned state (OC-N1, OC-N2) #349

Found by the independent acceptance in Cor-Incorporated/aidd-governance PR #210 (design/ops/measurements/h17-live-20261021/acceptance/README.md §2.3, repro opencode-346-348/attack/attack.test.ts.tmpl). Both bugs predate #346 / #348 (present on dev 111dbee071) and are unchanged by them.

The plugin-owned runtime .opencode/guardrails/state.json holds reviewed, factchecked, ci_green and consecutive_failures. A model that can write it can certify itself.

OC-N1 (P1): in-command cd and the no-slash runtime path

Setup: an ordinary session (server cwd == location == project). The shell call has no workdir.

Causes (packages/guardrails/profile/src/guardrail-access.ts at the #348 head 74d4016a0a):

• :112: file.includes(".opencode/guardrails/") requires the trailing slash, so cp … .opencode/guardrails and cd .opencode/guardrails are not seen.
• :65: workdirReachesRuntime returns false when the workdir is absent or equal to the session directory. It also does not follow cd inside the command.
• :118: the interpreter check uses .opencode/guardrails without the slash, so the two checks in one function disagree.

OC-N2 (P2): case variants of the runtime path

On case-insensitive APFS (the macOS default) both name the real state file (measured: true). Cause: guardrail-context.ts:202 owned() compares with a case-sensitive startsWith.

Fix direction

• Match the runtime dir in shell text without requiring the trailing slash (the dir name as a whole path segment).
• Follow in-command cd <path> with the same rule as workdir, even when workdir is absent or equals the session dir.
• Compare runtime paths case-insensitively where the filesystem is case-insensitive.

Done when

• adapter.test.ts rows for the inputs above go red on the pre-fix code and green after.
• Expose OpenRouter Gemini 3.5 Flash in deployed guardrails profile #208's coverage (28 BLOCK rows) and the false-positive rows of F5 stay green.
• cd packages/guardrails && bun test profile/src profile/plugins passes.

Out of scope here: OC-N3 (P3: glob in a redirect word, eval, sh -c from a .opencode workdir). #346 already declares that limit.