docs+demo: deep-gap closers — 211/0 re-score, HD1-HD4 scenes, status/README/scoring

Full authoritative run 2026-07-06: all 12 suites 211 PASS / 0 FAIL (KMS + container
isolation live via Vault dev + Docker; security-gate 11/0).
- run-hardening.sh: new "Vá đường lọt sâu" section (HD1 incident/kill-switch,
  HD2 multilingual VI/JA, HD3 true container isolation, HD4 split+classifier),
  closer updated to 211 checks.
- CASAN_HARDENING_STATUS.md: Phase 6 deep-gap closers table; test inventory
  175→211 (12 suites); C7/multilingual moved out of planned; C6 planned→partial
  (real isolation done); honest claim → H4 83, H2 82, H5/H6 stay 80 (infra-bound).
- scoring-report-02-after-competition.md: current state — 211/0, H4 80→83,
  H2 80→82, avg 80.9→81.6, lowest harness still 80 (H5/H6), 3-milestone table.
- README claim boundary: deep-gap closers listed; totals 175→211; H4/H2 bumps.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

00_SUBMISSION_PACKAGE/README.md

@@ -77,16 +77,21 @@ removed). Full status: `casan-next-plans/CASAN_HARDENING_STATUS.md`.
   dedup + dead-letter, fail-loud, end-to-end from a failing step); provider-telemetry
   API fetch + local-vs-provider reconciliation (catches token under-reporting);
   hosted dashboard with stale-aware `/healthz`; sliding-window circuit breaker (V15).
-- **Planned (NOT done — do not claim as production-ready):** multilingual H4,
-  classifier/split-injection resistance, HSM + KMS-by-default, live IdP (OIDC/JWT),
-  true WORM store (S3 Object Lock), incident kill-switch, true sandbox isolation,
-  deployed dashboard host + managed alert channel, real billing-API telemetry.
+- **Implemented + tested (deep-gap closers, post-competition):** incident response
+  + scoped kill-switch (C7, severity→auto-stop); multilingual VI/JA injection
+  detection (0 FP on benign VI/JA); TRUE container runtime isolation (C6, kernel
+  neutralises egress/host-read, validated live via Docker); split-injection
+  (assembled-context scan) + classifier-injection resistance.
+- **Planned (NOT done — do not claim as production-ready):** HSM + KMS-by-default,
+  live IdP (OIDC/JWT), true WORM store (S3 Object Lock), deployed dashboard host +
+  managed alert channel, real billing-API telemetry, model-digest pinning.
 
-Test totals: baseline 79 (run-casan4 35 + adversarial 44) preserved, **+96 new**
+Test totals: baseline 79 (run-casan4 35 + adversarial 44) preserved, **+132 new**
 hardening checks (Track A 25, Track C-MVP 29, Evidence Pack 7, H5-approval 8,
-H5-infra KMS+WORM 7, H6-agentops 20) = **175**, 0 fail — last full run 2026-07-05
-(KMS validated live 2026-07-04 via Vault; `evidence/scoring-run-report.md`). Fair
-maturity ~80/100 per harness; H5 rose 76→80 and H6 rose 79→80 so **no harness is
-below 80** (CASAN Level 4, proven by attack). See `CASAN_HARDENING_STATUS.md`.
-Because these live in **separate** suites, the demo attack battery counts in
-`video/01_video_recording_guide.md` are unchanged.
+H5-infra KMS+WORM 7, H6-agentops 20, C7-incident 15, H4-multilingual 7, C6-sandbox 6,
+H4-split-inject 8) = **211**, 0 fail — last full run 2026-07-05 (KMS + container
+isolation validated live via Vault + Docker; `evidence/scoring-run-report.md`).
+Fair maturity: H4 rose to 83 and H2 to 82 (deep-gap closers); H5/H6 stay at 80
+(remaining gaps are infra) so the lowest harness is still 80 — CASAN Level 4, proven
+by attack. See `CASAN_HARDENING_STATUS.md`. Because these live in **separate** suites,
+the demo attack battery counts in `video/01_video_recording_guide.md` are unchanged.