[agents] Protected-paths list has drifted across its parallel copies again: .gitlab-ci.yml missing from enforcement, .gitignore missing from fix-agent docs

## Observed symptom Protected-paths list has drifted across its parallel copies again: .gitlab-ci.yml missing from enforcement, .gitignore missing from fix-agent docs PR #1355 added `.gitignore` to `REVIEW_PROTECTED_PATHS` in both `env.runner` and `env.sandbox` blocks of `harness/review.yaml`, and to the hardcoded fallback array in `skills/pr-risk-assessment/scripts/risk-tier1.sh`, closing #850. The review agent flagged, correctly, that `agents/fix.md`'s independent prose 'Protected paths — do not modify' list (used to instruct the fix agent) was not updated to include `.gitignore` (https://github.com/fullsend-ai/agents/pull/1355#issuecomment-5722056399, remediation: add a bullet between `.gitattributes` and `.github/`). The PR merged anyway; `agents/fix.md` still omits `.gitignore` as of this writing (verified via `gh api repos/fullsend-ai/agents/contents/agents/fix.md`). Separately, I found the reverse gap already existed before this PR and remains unfixed: `agents/fix.md`'s list includes a bullet for `.gitlab-ci.yml` — GitLab CI configuration, but ## Environment GitHub fullsend-ai/agents #1362 ## Trigger / context Public GitHub report in fullsend-ai/agents (FRESH_14D). ## Source evidence - https://github.com/fullsend-ai/agents/issues/1362 (2026-09-18T12:52:26Z) — evidence_class: PRIMARY_ISSUE_REPORT — #1362 ## Freshness - classification: FRESH_14D - retrieved_at: 2026-10-02T10:50:53.329738Z - scout_id: C4313692f8c ## Scout notes This Problem was published by the KFA Fresh Friction Scout from public sources. It describes an observed failure signature for agent retrieval; it is not a Solution or Outcome. Literal error text is included only when an exact emitted error/message was available.