feat(agents): route high risk through controlled automation

apps/api/tests/test_iwooos_security_control_coverage.py

@@ -19,7 +19,7 @@ def test_iwooos_security_control_coverage_rolls_up_core_scopes() -> None:
     payload = load_latest_iwooos_security_control_coverage()
 
     assert payload["schema_version"] == "iwooos_security_control_coverage_v1"
-    assert payload["status"] == "committed_scope_rollup_ready_runtime_control_closed"
+    assert payload["status"] == "committed_scope_rollup_ready_with_controlled_apply_exception"
     assert payload["summary"]["source_snapshot_count"] == 8
     assert payload["summary"]["control_domain_count"] == 8
     assert payload["summary"]["visible_scope_unit_count"] == 160
@@ -63,6 +63,12 @@ def test_iwooos_security_control_coverage_keeps_runtime_gates_closed() -> None:
     assert summary["agent_bounty_runtime_gate_open_count"] == 0
     assert summary["ai_agent_runtime_write_gate_open_count"] == 0
     assert summary["all_scope_runtime_controlled"] is False
+    assert summary["allowlisted_controlled_apply_bypasses_iwooos_ledger"] is True
+    assert (
+        summary["controlled_apply_policy"]
+        == "low_medium_high_allowed_after_allowlist_check_mode_rollback_verifier_km"
+    )
+    assert summary["critical_break_glass_required"] is True
     assert all(domain["accepted_count"] == 0 for domain in payload["domains"])