Manual review request: aun-comfyui-nodes versions 2.23.0–2.29.1 Flagged/Banned, Manager stuck at 2.22.0

Publisher loz2754, node aun-comfyui-nodes (https://github.com/loz2754/AUN-ComfyUI-Nodes, https://registry.comfy.org/nodes/aun-comfyui-nodes).

Every version since 2.23.0 has been auto-moderated and ComfyUI Manager is pinned at 2.22.0 (latest Active). Uploads all succeed; versions then move to:
- Banned: 2.23.0 (1bbcb160-…), 2.24.0 (9b8cd69f-…), 2.25.0 (9c994617-…), 2.25.1 (f845fa3e-…), 2.26.0 (40667029-…)
- Flagged: 2.27.0 (4fc9eb7f-…), 2.28.0 (d7951057-…), 2.29.0 (19d4f7b1-…)
- Pending (fresh today, please include in review): 2.29.1 (2a5fd034-…)

I believe these are false positives. Potentially flagged patterns and why they're benign:
- subprocess calls are ffmpeg video assembly only (AUNSaveVideo.py, AUNJoinVideos.py), list-form args, no shell — identical code shipped in Active versions ≤2.22.0.
- fetch() is same-origin only (/aun/loras); no external network calls; innerHTML uses are escaped or static UI; localStorage/clipboard are UI state.
- PromptServer.send_sync graph messages are local ComfyUI events, unchanged since Active versions.
- The one scanner warning I could see (E702 semicolon, AUNExtractPowerLoras.py:116) is fixed in 2.29.1.

Request: manual review of 2.29.1 and clearance to Active (older Banned versions can stay as-is). Happy to change any specific pattern you point at.

Review the listed versions of aun-comfyui-nodes, starting with AUNSaveVideo.py, AUNJoinVideos.py, and AUNExtractPowerLoras.py:116, and compare them with the active versions through 2.22.0. Check the reported subprocess, fetch, innerHTML, and PromptServer patterns against the moderation findings. Done means completing manual review of 2.29.1 and determining whether it can move to Active.

Written by the indexing model from the issue text.