4dc0ed0ff0
BatchTool rebuilds its tool map from ToolRegistry.tools() without passing the caller agent, so agent-level permission filtering is bypassed. Add plan_exit to the DISALLOWED set to prevent non-plan agents from triggering it via batch.