Not a shrink to the pinned docker keys but a full removal: the pinning strips the branch layer only, so master's committed config is merged unstripped and its sandbox policy reaches every branch. The nightly job moves there with it. A rollback below v0.9.19 is no longer provided for. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>