[Copilot]

Array-valued originalTemplate parameters such as ["/etc/passwd", "::"] bypass the proposed containment checks because Twig tests array membership and accepts arrays as parent candidates. IO #1266 validates only the top-level template; decoded parameters still reach Twig.

• Guard

  • Includes the relevant guard from unmerged Ceres add check in template #3796, adding and originalTemplate is not iterable immediately after the defined check.
  • Preserves the order-confirmation fallback and valid plugin/core-style namespaced parents.

• Documentation

  • Updates English/German changelogs and documents a loader-instrumented end-to-end check with IO Feature/add widget preview images #1266.
  • Scope is the array-valued guard bypass—not strict string validation, demonstrated file disclosure, or complete loader security.