feat: plan 16 P1 (SEC-08/09/19/20/21) — fail-open/DoS/authz hardening

- SEC-08 pii-mask: fail-closed on missing rules / broken regex (no unmasked leak)
- SEC-09: input-size cap + fail-closed reads (security-check/drift-detect/context-compress); non-UTF8 no longer crashes
- SEC-19: control-plane store POSIX flock + atomic tmp+rename write
- SEC-20: new toolchain-verify.sh (missing/PATH-shadowed/in-workspace binary -> refuse); wired into harness-preflight
- SEC-21: model-call timeout 180->60s configurable + per-run call budget
- SEC-11 realized by SEC-17 prod profile (no code)
- 5 fail-able test suites wired into ci-harness-gate.sh; test-integrity manifest regenerated

Verify: SEC+integrity gate 16/0, run-casan4 0-FAIL, adversarial 44/44, no regressions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/scripts/bash/pii-mask.py

@@ -51,24 +51,35 @@ def load_rules(path):
 
 def main():
     data = sys.stdin.read()
+    # SEC-08 (M-06): FAIL CLOSED. Previously a missing rules file, an unreadable
+    # file, or a broken rule regex all emitted the RAW data — so a mask rule that
+    # failed to load silently leaked the PII it was meant to hide. Now any such
+    # condition emits NOTHING and exits non-zero: no unmasked content ever escapes.
     if len(sys.argv) < 2:
-        sys.stdout.write(data)
-        return
+        sys.stderr.write("PII_MASK_FAIL no rules file provided (fail-closed)\n")
+        return 1
     try:
         rules = load_rules(sys.argv[1])
-    except OSError:
-        sys.stdout.write(data)
-        return
+    except OSError as exc:
+        sys.stderr.write(f"PII_MASK_FAIL rules file unreadable (fail-closed): {exc}\n")
+        return 1
+    # Pre-compile every mask rule; a broken regex is fatal (that PII type would
+    # otherwise pass through unmasked). Validate all BEFORE emitting anything.
+    compiled = []
     for rule in rules:
         if rule.get("action") != "mask" or "regex" not in rule:
             continue
         token = REPLACEMENT_BY_TYPE.get(rule.get("type", ""), "***MASKED***")
         try:
-            data = re.sub(rule["regex"], token, data)
-        except re.error:
-            continue
+            compiled.append((re.compile(rule["regex"]), token))
+        except re.error as exc:
+            sys.stderr.write(f"PII_MASK_FAIL bad regex in rule {rule.get('id')} (fail-closed): {exc}\n")
+            return 1
+    for rx, token in compiled:
+        data = rx.sub(token, data)
     sys.stdout.write(data)
+    return 0
 
 
 if __name__ == "__main__":
-    main()
+    raise SystemExit(main())