An outbound effect switch is not a recipient safety boundary
An environment-level outbound allowlist or effect switch does not by itself constrain recipients. Before enabling a live canary that can send messages, inspect every code path in the invoked job: a composite scheduler may execute unrelated due-message work before or after the int…