[uk-ai-resilience] Four untracked go/bad-redirect-check alerts in pkg/cli and pkg/workflow (Tier B)

### Summary

Four new/recurring `go/bad-redirect-check` CodeQL alerts in actively-changed CLI/workflow-compiler files have **no matching open tracking issue**, breaking the classification → control-verification loop for this run's recent-changes scope (7-day lookback since 2026-09-01):

- Alert #674 — `pkg/cli/add_package_manifest_imports.go`
- Alert #669 — `pkg/workflow/graders_config.go`
- Alert #668 — `pkg/workflow/graders_config.go`
- Alert #667 — `pkg/cli/add_package_manifest_includes.go`

This is the same alert class flagged as a recurring false positive in #57472 (path-traversal/redirect guards), and the same class previously tracked individually for `add_package_manifest.go` in #54037.

### Tier & risk-scoring

- **Tier: B — Open With Conditions**
- Exposure amplification: Low–Medium
- Patchability: High
- Detectability: Medium (alert exists in code scanning, but untracked in issue backlog)
- Operational fragility: Medium
- Ownership confidence: Medium

### Remediation action

- Triage alerts #674, #669, #668, #667 individually: confirm whether each is a genuine incomplete-redirect-check bug or a false positive consistent with the pattern in #57472.
- If false positive, land a shared helper/annotation (e.g. a validated `isSafeRelativePath` utility checked for `//` and `/\` prefixes) across `pkg/cli` and `pkg/workflow` to eliminate the recurring finding class, then dismiss the alerts with that rationale.
- If genuine, patch the redirect/path checks in `add_package_manifest_imports.go`, `add_package_manifest_includes.go`, and `graders_config.go` to also reject `//` and `/\` prefixed inputs.
- Open explicit tracking issues (or link to this issue) for each alert so future dismissal-hygiene audits can verify closure state.

### SLA urgency

**High** — untracked alerts in actively-changed files reduce confidence in the classification step of the operational governance loop; low individual exploit likelihood keeps this at High rather than Critical.

### Related

- False-positive pattern: #57472
- Prior single-file precedent: #54037
- Full governance report: see linked discussion for this run.

> Generated by [UK AI Operational Resilience](https://github.com/github/gh-aw/actions/runs/34245243100) · copilot · auto · 55.1 AIC · ⌖ 12.6 AIC · ⊞ 8.1K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Fuk-ai-operational-resilience%22&type=issues)

Review alerts #674, #669, #668, and #667 in pkg/cli/add_package_manifest_imports.go, pkg/cli/add_package_manifest_includes.go, and pkg/workflow/graders_config.go, then compare them with false-positive pattern #57472 and precedent #54037. Done means each alert is confirmed genuine or false positive, the affected checks are addressed when needed, and every alert has an explicit tracking or dismissal rationale.

Written by the indexing model from the issue text.