host diff: unread-input headline for workflows, bind command-setting scripts, align Action redaction, model disabledMcpjsonServers, endpoint URL path changes #1084

Deferred by the engineering-review implementation loop from #1083 (issue #1027).

Problem

Five host-diff coverage gaps beside #1027's fix, each with file:line evidence in the PR #1083 body:

1. A changed workflow file, or a changed input no reader reads (Name relevant inputs the host entry does not read, so a zero-row result is never read as covered (#812 slice 2) #821), with no row still prints "No static host-grant changes detected"; host diff: model statusLine, apiKeyHelper and endpoint env keys; no false 'no changes' #1027 changed the headline only for settings, MCP and hook files.
2. Scripts that a command setting (statusLine, apiKeyHelper, …) runs are not compared; only hook scripts are bound (src/agents_shipgate/core/host_grants.py:5174).
3. The claude-code-action settings input still redacts apiKeyHelper, which no longer matches the settings reader after host diff: model statusLine, apiKeyHelper and endpoint env keys; no false 'no changes' #1027 (docs/host-boundary-support.md:541).
4. The cold-start oracle counts disabledMcpjsonServers as supported, but no reader models it.
5. A change to only the path of an ANTHROPIC_BASE_URL value gives no row (same class as An MCP server URL's path is outside its change digest: /read → /admin produces no row #772, where an MCP server URL's path is outside its change digest).

Proposed fix

(1) Extend the "Changed, not compared" headline to every changed input the comparison lists as unread. (2) Bind command-setting scripts the way hook scripts are bound, with the same digest and launch-source rules. (3) Align the Action's settings-input redaction with the settings reader. (4) Either model disabledMcpjsonServers (a narrowing of the MCP set) or drop it from the oracle. (5) Decide with #772 whether a URL path change is a row; apply the same rule to endpoint env values.

Acceptance criteria

• No comparison that lists an unread changed input prints the no-change headline.
• A changed statusLine script body produces a row.
• The oracle and the readers agree on disabledMcpjsonServers.

Source

Engineering review 2026-10-12 follow-up (PR #1083 implementer notes). Related: #772, #821. Tracked in #1060.