Follow-up: accept passive independently owned route blockers after #409

Start with forbidden_route_only_contradiction? and the existing routing contract in skills/pr-batch/bin/model-routing-contract-test.rb; reproduce the passive blocker case on the referenced merged commit. Add the regression mutant and positive controls while preserving the stated routing behaviors, then run AGENT_WORKFLOWS_SOURCE_CHECKOUT=1 ruby skills/pr-batch/bin/model-routing-contract-test.rb and bin/validate; done includes reconciling the original PR #409 thread.

Problem

PR #409 merged advisory-routing mutation coverage, but the merged contradiction detector still rejects a policy-compliant passive independent-blocker sentence:

A route mismatch occurs, but launch is blocked by a credential check.

forbidden_route_only_contradiction? returns true. The detector recognizes active independent ownership such as “a credential check blocks launch,” but not the passive form “launch is blocked by a credential check.” It therefore incorrectly attributes the blocked launch to the route mismatch.

This was reported before merge in https://github.com/shakacode/agent-workflows/pull/409#discussion_r3848708964 and remained unresolved when PR #409 merged.

Expected behavior

• Accept passive independently owned blocker clauses where the blocking owner is an existing independent risk, scope, evidence, authority, credential, or security gate.
• Continue rejecting unconditional route-only stops.
• Preserve negation, fence/comment, paragraph-boundary, and same-sentence ownership behavior already covered by the routing contract.

Acceptance criteria

• Add a direct regression mutant for the sentence above.
• Add nearby positive controls proving a route mismatch still cannot itself block launch.
• Run AGENT_WORKFLOWS_SOURCE_CHECKOUT=1 ruby skills/pr-batch/bin/model-routing-contract-test.rb and bin/validate.
• Reconcile and resolve the original PR #409 thread with the follow-up PR evidence.

Process Gap Disposition

• Mechanism target: script
• Motivating miss: PR #409 merged with an unresolved P2 thread and a reproducible false positive in the required routing contract.
• Replay evidence or park reason: run forbidden_route_only_contradiction? against A route mismatch occurs, but launch is blocked by a credential check. on merged commit 42946dae47effeb549cf06fbdf2451e8bed705cb; it returns true.
• Non-goal: replacing the bounded routing mutation detector with a general natural-language or CommonMark parsing framework.