We need a trust-scope hardening pass

We need a trust-scope hardening pass to ensure that we are able to isolate Claude Code inputs from tool use, in particular to address a series of bugs plaguing vsdd-factory, but also to address the equally serious but not-yet-observed attack surface resulting from malicious misuse of this weakness. See https://github.com/anthropics/claude-code/issues/67529 for more information.

This is mostly a reminder that this should be addressed (even if the specific challenge demonstrated in the claude code issue report is patched.)