New code can refuse macOS automounter-lookup paths, but nothing in this build turns it on
A new internal permission check can refuse to read a file path if it looks like a macOS "automounter" lookup path, such as the /Network browse root or an auto_home entry, with its own denial message and reason code. However, this check only runs when an optional setting called refuseAutomounterShapes is passed in, and the only place in the codebase that calls this check never passes that setting, so the new refusal never actually triggers.
This is dormant code: the capability exists internally, but no path in this build exercises it, so it has no effect on current behavior yet.