feat: plan 16 P2 batch 2 (SEC-12 drift, SEC-29 audit fail-closed, SEC-30 replay, SEC-15 low)

- SEC-12: drift-detect adds semantic invariants — negation-flip detection (a dropped
  "not" now FAILS despite high char-similarity) + env must-keep patterns.
- SEC-29 (X-05): governance-check audit write fails CLOSED — an unwritable audit log
  denies the action and empties the output (no unaudited output).
- SEC-30 (X-06): approval-verify records a one-time-use nonce (sha of token/sig) and
  rejects replays (enforced mode / when a nonce ledger is set); dev unchanged.
- SEC-15 (low): typosquat distance<=2 with the levenshtein length-sentinel bug fixed
  (no false positives); tool-exec fails closed with no timeout backend in enforced
  mode; validate-tool-input now validates nested objects/arrays recursively.

Verify: new SEC suites all green via gate, run-casan4 0-FAIL, adversarial 44/44,
track-c 29/0, h5-approval 12/0, no regressions.

Plan-16 P2 remaining: infra-gated only (SEC-14/22/23/24/25/26).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/tests/test-integrity-manifest.json

@@ -96,10 +96,18 @@
       "sha256": "099c81a0a37b51137dbf328dbe2ef778226d0716b97660d083c1fcc6a4aecd19",
       "checks": 5
     },
+    "phase-sec12-tests.sh": {
+      "sha256": "9993eec8c2384e59389723672ed7f2eadc9f112e680ec6505b62b94f4780ccb4",
+      "checks": 5
+    },
     "phase-sec13-tests.sh": {
       "sha256": "64d67fa0ccf9c199848323e8fb6207f0cbc9608f6e256a0a7337b371c0451b43",
       "checks": 6
     },
+    "phase-sec15-tests.sh": {
+      "sha256": "32736ec6e665d11dabf230cf26e2355a1d4d2ee4050bb5ce8aa9decd9e925d1b",
+      "checks": 7
+    },
     "phase-sec16-tests.sh": {
       "sha256": "3d826ca4f5c8f98837cc70846b8e2f2f83d5a598c2a5907795e8b9cc9db448c2",
       "checks": 6
@@ -128,6 +136,14 @@
       "sha256": "8f082c85b80bf899ea1911e8165e28c14f691e1ac3605953cd1b968ee295e556",
       "checks": 4
     },
+    "phase-sec29-tests.sh": {
+      "sha256": "f7c339e628904b9bfbbbb9ed9fd88ddd50e74131d62630c93fdba3bf6fef4c04",
+      "checks": 3
+    },
+    "phase-sec30-tests.sh": {
+      "sha256": "534fc41302c6bbf60fb81e1185ad032d85fea2225517b01653d750044731437f",
+      "checks": 3
+    },
     "phase-selfimprove-tests.sh": {
       "sha256": "e91db1af16e30b18def130553f27f05691ff5540eca0593ca5e07f624c0ef938",
       "checks": 7
@@ -173,6 +189,6 @@
       "checks": 10
     }
   },
-  "total_checks": 356,
-  "suite_count": 43
+  "total_checks": 374,
+  "suite_count": 47
 }