FN-8490 + graph-owned-cutover follow-ups shifted lines above 5 allowlisted deterministic git-plumbing execSync sites (self-healing.ts, executor.ts), breaking the call-site file:line:signature match. Refresh the pinned lines to restore the engine-no-blocking-shellout static guard signal. No production behavior change; sites are unchanged legitimate git plumbing.