feat: plan 16 P2 batch 1 (SEC-13 SSRF, SEC-27 log-escape, SEC-28 path-traversal)

- SEC-13 (M-09): SSRF allowlist on provider-usage-fetch (always block non-http(s)
  schemes; enforced mode blocks internal/link-local IPs + non-allowlisted hosts,
  dev keeps loopback mocks); dashboard refuses non-loopback bind in enforced mode.
- SEC-27 (X-02): casan-log strips ESC/CSI + CR/LF (terminal-escape + fake-log-line
  injection) while keeping tab and visible text.
- SEC-28 (X-04): new path-guard.sh — realpath resolve + reject symlink/.. escapes
  outside the allowed root.

Verify: SEC-13 6/0, SEC-27 3/0, SEC-28 4/0, adversarial 44/44, run-casan4 0-FAIL.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json.sig

@@ -1 +1,4 @@
-�Bָ��ק³מ�‘wvם‏»ָ«4״ה4"ק.=nN;␍ֹ'�b™A(װBֺdiS�Rq±�ס3‎¥\V×ַָp²כ
ֽw¬'שwצ-¦ב�kֵ�¯Xoֿ€×Ru­™�n~רמ�|�C-O°}´�lםS% z��j�תG�Tז`�e]V־™␍�¯­שיה¯f₪³_}ףקכױK¼t!‏<קB␍qhה1ך₪E‎הל`z“iס´whיס�?ְִֵ¿~ִmCַ/…׃cֲבQ ׂ¨�‘]¹¶s�yb‏„�„¥'�ֹ2ץו4עZx?»^קמ_×הֳWײO
+Wγ)΄¦ϊκ²>DιIΘ�–&zbFΟγϊΩZζ¬η&,—ΏΌε�Ϊ^·›;¦­�ΫΙ’ΰ�υίk’οωo™"�Η<Έ�STε'›CΘt�©μσa©δ
+Θ2+·Ξµγ4’Bl¨€“��εfO�"y3—γ	*N†Ϊ
+x„Λέ±�‹u…
dσΧθ�Λ“DY�¬³Δ{™0ήν¥Μ5ψ‰xg§Β€�½±»Ώ‡*mτεΛγρ Χn
+k.Φ²MΣGD¨ƒ5§iΫ²ΰ΄2eH�kINήΦsάJ®Ξ+°PhΟΫΌxϊ�=<2y„{σe	�Ψ·Λ¨hΠnβ‘Νδ