In a CI pipeline, false positives from tests that only check 'no tools called' will keep letting substandard agent versions through until problems surface in production.