Prevent runaway mutations at eval seam.
S1: Create boundary_gate.metta with allowlist
PASS: (allowed-cmd shell)=True, (allowed-cmd rm-rf)=False
S2: Path sandbox checker
PASS: /root/safe/=True, /etc/passwd=False
S3: Test car-atom in PeTTa
PASS: output=a. FAIL: use alternative
S4: Patch loop.metta line ~56
Replace (eval $s) with gate wrapper
S5: 5-case acceptance test
PASS: 5/5 correct. FAIL: do not merge
S6: Submit PR to Jon
Send diff + test output. No unilateral merge.