feat: adopt security zones and explicit workload refs

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a0291a-1e87-7151-9934-fcbfe3f65eb1

scripts/emit_high_risk_paths.py

@@ -136,8 +136,13 @@ def main() -> int:
     if args.check:
         current = args.out.read_text() if args.out.exists() else ""
         # generated_at always differs; compare everything else.
-        strip = lambda t: "\n".join(l for l in t.splitlines() if not l.startswith("generated_at:"))
-        if strip(current) != strip(content):
+        def strip_generated_at(text: str) -> str:
+            return "\n".join(
+                line for line in text.splitlines()
+                if not line.startswith("generated_at:")
+            )
+
+        if strip_generated_at(current) != strip_generated_at(content):
             print(f"STALE: {args.out} does not match the catalog. Re-run without --check.")
             return 1
         print(f"fresh: {args.out} matches the catalog ({count} concrete paths)")