Automation: the file-parameter audit counts RUNS_SCRIPTS as classified

file.runScript and script.run moved from REFUSED to RUNS_SCRIPTS, which
check_command refuses too; the audit test now looks there as well.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/automation/src/confine.rs

@@ -396,6 +396,7 @@ mod tests {
             let classified = keys_of(READS, id).is_some()
                 || keys_of(WRITES, id).is_some()
                 || REFUSED.contains(&id)
+                || effectcraft_engine::commands::scripts::RUNS_SCRIPTS.contains(&id)
                 || IMPLICIT_WRITES.contains(&id)
                 || id.starts_with("renderQueue.")
                 || id == "render.addOutputModule"