placeholder-probe

# Render-time placeholder probe (issue #1264 precondition) PHPROBE_LINE_A: !`.github/probe-plugin/phprobe-read-env.sh` <!-- The line above is the entire measurement. Three limbs at once: (a) SUBSTITUTION — if claude-code-action renders the placeholder, `PHPROBE_LINE_A:` is followed by the script's stdout (`PHPROBE_ENV <value>`). If it does not, the raw `!`-backtick text survives verbatim and the agent echoes that back instead. (b) ENVIRONMENT — the script reads DEVFLOW_PROMPT_EXTENSION_ROOT, which the probe job sets to a sentinel via the step-level `env:`, and reports the literal token UNSET when it is absent rather than emitting an empty line. (c) ALLOWLIST GATING — ALREADY ANSWERED, NEGATIVE, and the job's grant records that answer rather than contradicting it. The head is a repo-relative script path, not `printf`. It was deliberately withheld at first, and rendering was REFUSED — run 31058504896, `This command requires approval` — so placeholder rendering IS gated by --allowed-tools. The job therefore grants `Bash(.github/probe-plugin/phprobe-read-env.sh:*)` alongside `Bash(printf:*)` and `Skill`: with (c) settled, that grant is the only thing that makes limbs (a) and (b) observable at all (four consecutive runs were refused before substitution could ever be seen). Do not "restore" the withheld form — it re-measures a settled limb and blinds the two that are still open. WHY THE COMMAND IS...