Sub-ticket of PLUTO-454 SCANNER_PROBE_RE canonical addendum: bare /Dockerfile probe shape (no extension) — residual missed by PLUTO-453 A-H (all ext/dotdir/exact-token anchored). In 07:32 cross-app sweep (mars MARS-341 surfaced it), keeps warn-paging all 3 apps. Candidate literal (mars-proposed): /(^|\/)Dockerfile(?:$|[./-])/ — any-segment (scanners nest), boundary-bounded (covers /Dockerfile.prod /Dockerfile-dev /docker/Dockerfile; excludes /Dockerfilefoo). Pluto-canonical; mars/venus byte-align after. Gates: audit confirm Pluto post-cutover warn evidence + collision vs manifest + literal boundary review, then coder --patch ride + PTD live-probe (/Dockerfile -> silent security/info). · pluto