Isolation partially leaked: blind agent observed:
- repo path /Users/justnau/finlet (filesystem)
- git log showing recent commits (Bash access)
- project name "Finlet" / "AI Trading Agent ITE" (likely from session context inherited despite env -i)
- presence of docs/bug-hunt/ directory (filesystem)

NOT architecture facts (no mention of date ceiling enforcer, plugin registry internals,
or session lifecycle), so per skill spec this is a soft warning, not a hard fail.
The walkthrough still produced credible BROKEN findings with specific URLs + evidence.

Hardening idea for next iteration: launcher should chdir into a tmp dir before exec,
not run from REPO_ROOT.
