feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal)

- SEC-13 (M-09): SSRF allowlist on provider-usage-fetch (always block non-http(s)
  schemes; enforced mode blocks internal/link-local IPs + non-allowlisted hosts,
  dev keeps loopback mocks); dashboard refuses non-loopback bind in enforced mode.
- SEC-27 (X-02): casan-log strips ESC/CSI + CR/LF (terminal-escape + fake-log-line
  injection) while keeping tab and visible text.
- SEC-28 (X-04): new path-guard.sh — realpath resolve + reject symlink/.. escapes
  outside the allowed root.

Verify: SEC-13 6/0, SEC-27 3/0, SEC-28 4/0, adversarial 44/44, run-casan4 0-FAIL.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json

@@ -96,6 +96,10 @@
       "sha256": "099c81a0a37b51137dbf328dbe2ef778226d0716b97660d083c1fcc6a4aecd19",
       "checks": 5
     },
+    "phase-sec13-tests.sh": {
+      "sha256": "64d67fa0ccf9c199848323e8fb6207f0cbc9608f6e256a0a7337b371c0451b43",
+      "checks": 6
+    },
     "phase-sec16-tests.sh": {
       "sha256": "3d826ca4f5c8f98837cc70846b8e2f2f83d5a598c2a5907795e8b9cc9db448c2",
       "checks": 6
@@ -116,6 +120,14 @@
       "sha256": "303503fb3670be7d1b3c2737451eff64e7f140e940d2ae16188f686af0992dfa",
       "checks": 4
     },
+    "phase-sec27-tests.sh": {
+      "sha256": "1096f622ef010aecd44b9545c72f32a3b31009c3b250f4424d92018d74830e87",
+      "checks": 3
+    },
+    "phase-sec28-tests.sh": {
+      "sha256": "8f082c85b80bf899ea1911e8165e28c14f691e1ac3605953cd1b968ee295e556",
+      "checks": 4
+    },
     "phase-selfimprove-tests.sh": {
       "sha256": "e91db1af16e30b18def130553f27f05691ff5540eca0593ca5e07f624c0ef938",
       "checks": 7
@@ -161,6 +173,6 @@
       "checks": 10
     }
   },
-  "total_checks": 343,
-  "suite_count": 40
+  "total_checks": 356,
+  "suite_count": 43
 }