test(security): consolidate runtime guardrail scans

src/security/audit.test.ts

@@ -2234,7 +2234,7 @@ describe("security audit", () => {
     }
   });
 
-  it("flags plugins with dangerous code patterns (deep audit)", async () => {
+  it("does not scan plugin code safety findings when deep audit is disabled", async () => {
     const tmpDir = await makeTmpDir("audit-scanner-plugin");
     const pluginDir = path.join(tmpDir, "extensions", "evil-plugin");
     await fs.mkdir(path.join(pluginDir, ".hidden"), { recursive: true });
@@ -2260,20 +2260,7 @@ describe("security audit", () => {
     });
     expect(nonDeepRes.findings.some((f) => f.checkId === "plugins.code_safety")).toBe(false);
 
-    const deepRes = await runSecurityAudit({
-      config: cfg,
-      includeFilesystem: true,
-      includeChannelSecurity: false,
-      deep: true,
-      stateDir: tmpDir,
-      probeGatewayFn: async (opts) => successfulProbeResult(opts.url),
-    });
-
-    expect(
-      deepRes.findings.some(
-        (f) => f.checkId === "plugins.code_safety" && f.severity === "critical",
-      ),
-    ).toBe(true);
+    // Deep-mode positive coverage lives in the detailed plugin+skills code-safety test below.
   });
 
   it("reports detailed code-safety issues for both plugins and skills", async () => {