file.runScript and script.run moved from REFUSED to RUNS_SCRIPTS, which check_command refuses too; the audit test now looks there as well. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>