devbox add --allow-insecure flag does not properly whitelist insecure packages and is not persisted

devbox add --allow-insecure flag does not properly whitelist insecure packages and is not persisted: a task in LegoFlow-SWE (Harbor dataset). What the agent is asked, how it is graded, what it runs in, and its files.