Parse escaped quotes in catalog values, and check real deploy contracts

Changes

diff --git a/src/ec2/host.rs b/src/ec2/host.rs
index ad788c6..1e553e8 100644
--- a/src/ec2/host.rs
+++ b/src/ec2/host.rs
@@ -582,8 +582,12 @@ fn audit_app(app: &AppCfg) -> FleetAuditEntry {
     }
     // The catalog `deploy` field is manual-fallback tooling, not something
     // Build enforcement reads, but a raw direct-deploy command invites
-    // bypassing Build by hand — flag it as a policy violation too.
-    if !app.deploy.is_empty() && !app.deploy.contains("akurai-build:") {
+    // bypassing Build by hand — flag it as a policy violation too. Match the
+    // real tool-call sequence rather than the bare `akurai-build:` label: the
+    // label is prose that proves nothing, and a field naming the actual
+    // repo_sync -> run_queue -> run_promote calls with their argument keys is
+    // something a caller can execute.
+    if !app.deploy.is_empty() && !is_executable_deploy_contract(&app.deploy) {
         violations.push(format!(
             "AKURAI_APPS.toml deploy field bypasses AkurAI Build: {}",
             app.deploy
@@ -671,14 +675,56 @@ fn parse_apps_toml(text: &str) -> Vec<AppCfg> {
     apps
 }
 
+/// A catalog `deploy` field is only worth trusting if it names the real MCP
+/// tool-call sequence with its argument keys -- `akurai_repo_sync` with
+/// `name=`/`source=`, then `akurai_run_queue` with `repository=`, then
+/// `akurai_run_promote` with `id=`/`environment=`. Prose, a bare
+/// `akurai-build:` label, or a raw `ec2 release` command does not qualify,
+/// however plausible it reads.
+fn is_executable_deploy_contract(deploy: &str) -> bool {
+    const REQUIRED_TOKENS: &[&str] = &[
+        "akurai_repo_sync",
+        "name=",
+        "source=",
+        "akurai_run_queue",
+        "repository=",
+        "akurai_run_promote",
+        "id=",
+        "environment=",
+    ];
+    REQUIRED_TOKENS.iter().all(|token| deploy.contains(token))
+}
+
 fn toml_value(raw: &str) -> String {
     let raw = raw.trim();
     if let Some(stripped) = raw.strip_prefix('"') {
         // Quoted string: up to the closing quote (trailing comment stays out).
-        if let Some(end) = stripped.find('"') {
-            return stripped[..end].to_string();
+        // `find('"')` is not good enough -- TOML basic strings escape an inner
+        // quote as \" , and stopping at the first raw quote truncates the value
+        // there. A `deploy` field carrying tool-call arguments
+        // (name=\"AkurAI-Platform\", ...) came back as `...repo_sync(name=\`,
+        // silently dropping everything a caller wanted to read.
+        let mut value = String::with_capacity(stripped.len());
+        let mut characters = stripped.chars();
+        while let Some(character) = characters.next() {
+            match character {
+                '"' => return value,
+                '\\' => match characters.next() {
+                    // Only the escapes this catalog actually uses; anything
+                    // else keeps both characters so nothing is silently eaten.
+                    Some('"') => value.push('"'),
+                    Some('\\') => value.push('\\'),
+                    Some(other) => {
+                        value.push('\\');
+                        value.push(other);
+                    }
+                    None => value.push('\\'),
+                },
+                other => value.push(other),
+            }
         }
-        return stripped.to_string();
+        // Unterminated string: return what we have, as before.
+        return value;
     }
     // Bare word / boolean / integer.
     raw.split([' ', '#']).next().unwrap_or("").to_string()
@@ -777,6 +823,80 @@ fn free_ports(reg: &Registry, live: &LiveState) -> Vec<u16> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn toml_value_keeps_escaped_quotes_instead_of_truncating() {
+        // The regression: `find('"')` stopped at the first quote of an inner
+        // \" escape, so a deploy field carrying tool-call arguments was cut
+        // down to `...repo_sync(name=\` and every token after it vanished.
+        let raw = r#""mcp__akurai_build__akurai_repo_sync(name=\"AkurAI-Platform\", source=\"/p\") -> done""#;
+        let value = toml_value(raw);
+        assert!(
+            value.contains("source=") && value.ends_with("done"),
+            "escaped quotes must not truncate the value: {value:?}"
+        );
+        assert_eq!(value.matches('"').count(), 4, "escapes unescape to quotes");
+    }
+
+    #[test]
+    fn toml_value_still_stops_at_the_real_closing_quote() {
+        assert_eq!(
+            toml_value(r#""plain value"   # trailing comment"#),
+            "plain value"
+        );
+        assert_eq!(toml_value("bare_word # comment"), "bare_word");
+        assert_eq!(toml_value(r#""unterminated"#), "unterminated");
+        // A lone backslash must not swallow the terminator or panic.
+        assert_eq!(
+            toml_value(r#""ends with backslash \"#),
+            "ends with backslash \\"
+        );
+    }
+
+    #[test]
+    fn executable_deploy_contract_accepts_real_calls_and_rejects_prose() {
+        let real = "mcp__akurai_build__akurai_repo_sync(name=\"A\", source=\"/p\") -> \
+                    mcp__akurai_build__akurai_run_queue(repository=\"A\", commit=<sha>) -> \
+                    mcp__akurai_build__akurai_run_promote(id=<run>, environment=\"production\")";
+        assert!(is_executable_deploy_contract(real));
+        assert!(!is_executable_deploy_contract(
+            "akurai-build: akurai_repo_sync a -> akurai_run_queue(commit=<sha>) -> akurai_run_promote(id, environment=production)"
+        ));
+        assert!(!is_executable_deploy_contract(
+            "akurai-ec2 release akurai-platform"
+        ));
+        assert!(!is_executable_deploy_contract(""));
+    }
+
+    #[test]
+    fn live_catalog_deploy_fields_survive_parsing_and_are_executable() {
+        // Reads the real AKURAI_APPS.toml rather than a fixture, because the
+        // defect only appeared against the real file: the fixture-shaped
+        // values had no escaped quotes. Skips when the sibling checkout is
+        // absent (CI containers), and says so rather than passing silently.
+        let Ok(home) = std::env::var("HOME") else {
+            eprintln!("skipped: HOME unset");
+            return;
+        };
+        let path = Path::new(&home).join("Projects/AkurAI-Framework/AKURAI_APPS.toml");
+        let Ok(text) = std::fs::read_to_string(&path) else {
+            eprintln!("skipped: {} not present", path.display());
+            return;
+        };
+        let apps: Vec<AppCfg> = parse_apps_toml(&text)
+            .into_iter()
+            .filter(|app| !app.retired && !app.name.is_empty() && !app.deploy.is_empty())
+            .collect();
+        assert!(!apps.is_empty(), "catalog parsed to zero deployable apps");
+        for app in &apps {
+            assert!(
+                !app.deploy.ends_with('\\'),
+                "app {} deploy value was truncated at an escape: {}",
+                app.name,
+                app.deploy
+            );
+        }
+    }
+
     #[test]
     fn registry_parsing_skips_comments_and_garbage() {
         let text = "# port|unit|domain|repo|pool|note\n8094|mail|mail.olibuijr.com|akurai-mail|app|primary mail\n\n|bad|row\n8199|system-thing|-|repo|system|note with|extra pipes\n";