Handle manifest-free verified builtin providers in policy staging

Co-Authored-By: Paperclip <noreply@paperclip.ing>

packages/paperclip-runner/src/drivers/acpx/runtime-host.ts

@@ -412,7 +412,12 @@ export class AcpxRuntimeHost {
             ...(options.providerPolicy === undefined ? {} : { providerPolicy: {
               ...options.providerPolicy,
               systemInstructions: boundedInstructions(options.systemInstructions),
-              protectedPaths: [...(options.providerPolicy.protectedPaths ?? []), dirname(installation.agentServerPackageJsonPath)],
+              protectedPaths: [
+                ...(options.providerPolicy.protectedPaths ?? []),
+                ...(installation.agentServerPackageJsonPath === null
+                  ? []
+                  : [dirname(installation.agentServerPackageJsonPath)]),
+              ],
             } }),
           }),
         dependencies.retainAdmissionCleanup,