airlock prompt-injection guardrail bypassed in unattended agent runs

A researcher found that the airlock guardrail plugin for Hermes Agent let data leave in non-interactive sessions: a hermes -z turn classified as approve ran without asking a human. The flaw (GHSA-mgf8-gh7g-q4rg) is fixed in airlock 0.2.3, which now accounts for all auto-approval modes including -z, -q, cron, webhooks and subagents.

• In a oneshot hermes -z run, data was sent out with no approval prompt
• Cause: airlock checked global flags, not the per-turn unattended state
• airlock 0.2.3 asks Hermes's approval code why it would approve alone
• Fix covers --yolo, /yolo, -z, -q, cron, webhooks and subagents