fix: 词表墙的四项审查修复（es 池降级/占位符白名单校验/键 allowlist/提取自检+防呆测试）

Co-Authored-By: Claude Code <noreply@anthropic.com>

app/engine/services/boundary_filter.py

@@ -101,7 +101,11 @@ def pivot_for(user_msg: str, has_contact: bool = False,
               wall: CompiledWall | None = None) -> str:
     w = wall or DEFAULT_WALL
     lang = _lang_pool(user_msg)
-    pool = (w.pivots_contact if has_contact else w.pivots)[lang]
+    pools = w.pivots_contact if has_contact else w.pivots
+    # 缺池语言优雅降级(审查 I-1): 租户墙可无 es 池(auto 中英+$ 词表),西语
+    # 消息按重音符路由 es 后回落 EN 池——与 _lang_pool 注释的罗曼语族降级
+    # 取舍同源(宁可降级不可 KeyError 炸会话流)。
+    pool = pools.get(lang) or pools["en"]
     return pool[0]
 
 
@@ -110,7 +114,9 @@ def deflection_for(user_msg: str, rotate: int = 0,
                    wall: CompiledWall | None = None) -> str:
     w = wall or DEFAULT_WALL
     lang = _lang_pool(user_msg)
-    pool = (w.deflections_contact if has_contact else w.deflections)[lang]
+    pools = w.deflections_contact if has_contact else w.deflections
+    # 缺池语言优雅降级(审查 I-1): 同 pivot_for,回落 EN 池
+    pool = pools.get(lang) or pools["en"]
     return pool[rotate % len(pool)]