### Task 11: Regression guard against silent bypass reintroduction

**Rationale:** The bypass regression was invisible for many releases. Add a cheap static guard so it can't silently return.

**Files:**
- Test: `tests/orchestrator/test_no_bypass_permissions_regression.py` (create)

- [ ] **Step 1: Write the guard test**

```python
# tests/orchestrator/test_no_bypass_permissions_regression.py
from pathlib import Path
import claw_forge


def test_no_bypass_permissions_in_dispatch_source():
    root = Path(claw_forge.__file__).parent
    th = (root / "orchestrator" / "task_handler.py").read_text()
    assert "bypassPermissions" not in th, (
        "dispatch path must not use bypassPermissions — it disables can_use_tool"
    )
```

- [ ] **Step 2: Run to verify it passes** (Task 10 already removed the string).

Run: `uv run pytest tests/orchestrator/test_no_bypass_permissions_regression.py -v`
Expected: PASS.

- [ ] **Step 3: Commit**

```bash
git add tests/orchestrator/test_no_bypass_permissions_regression.py
git commit -m "test(security): guard against bypassPermissions reintroduction on dispatch path"
```

---

