Function sanitize_imported_step 

fn sanitize_imported_step(step: &mut RoutineStep)

Clear any field of a step arriving from an UNSIGNED imported pack that only the signed-plugin installer is allowed to populate.

The exhaustive destructure (no ..) is the gate, not decoration: adding a field to RoutineStep will fail to compile here until someone explicitly decides whether an untrusted imported pack may carry it. That turns “did we remember to harden the import path too?” from a review checklist into a build error.