feat: plan 16 P1 (SEC-08/09/19/20/21) — fail-open/DoS/authz hardening

- SEC-08 pii-mask: fail-closed on missing rules / broken regex (no unmasked leak)
- SEC-09: input-size cap + fail-closed reads (security-check/drift-detect/context-compress); non-UTF8 no longer crashes
- SEC-19: control-plane store POSIX flock + atomic tmp+rename write
- SEC-20: new toolchain-verify.sh (missing/PATH-shadowed/in-workspace binary -> refuse); wired into harness-preflight
- SEC-21: model-call timeout 180->60s configurable + per-run call budget
- SEC-11 realized by SEC-17 prod profile (no code)
- 5 fail-able test suites wired into ci-harness-gate.sh; test-integrity manifest regenerated

Verify: SEC+integrity gate 16/0, run-casan4 0-FAIL, adversarial 44/44, no regressions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AINative_OKR_CASAN5/.specify/scripts/bash/toolchain-verify.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN Plan-16 SEC-20 (ARCH-04 / ARCH-09) — verify the required toolchain.
+#
+# Gate verdicts depend on external binaries (python/openssl/grep/sha256sum...). If
+# one is MISSING the control can silently no-op (ARCH-09); if one is PATH-SHADOWED
+# by an attacker-planted copy (ARCH-04, e.g. a fake `grep` that always matches
+# nothing) the attacker controls the verdict. This fails CLOSED:
+#   * a required tool that is not found  -> refuse,
+#   * a tool resolving INSIDE the workspace / cwd  -> refuse (planted binary),
+#   * with CASAN_TOOLCHAIN_TRUSTED_DIRS set, a tool outside those dirs -> refuse.
+#
+# Usage:  toolchain-verify.sh [tool ...]        (default: python3 openssl grep awk sed)
+# Env:    CASAN_TOOLCHAIN_TRUSTED_DIRS=/usr/bin:/bin:...  (opt-in allowlist; prod sets it)
+# Exit:   0 ok, 1 missing/shadowed/untrusted.
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+PROJECT_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+
+REQUIRED=("$@")
+if [[ ${#REQUIRED[@]} -eq 0 ]]; then
+  REQUIRED=(python3 openssl grep awk sed)
+fi
+
+IFS=':' read -r -a TRUSTED <<< "${CASAN_TOOLCHAIN_TRUSTED_DIRS:-}"
+
+fail=0
+for tool in "${REQUIRED[@]}"; do
+  path="$(command -v "$tool" 2>/dev/null || true)"
+  if [[ -z "$path" ]]; then
+    echo "TOOLCHAIN_MISSING tool=$tool (fail-closed)" >&2
+    fail=1; continue
+  fi
+  # Resolve to a real, absolute path (follow the symlink dir).
+  dir="$(cd "$(dirname "$path")" 2>/dev/null && pwd -P || echo "")"
+  real="$dir/$(basename "$path")"
+
+  # A required tool resolving inside the repo / cwd is a planted-binary red flag.
+  case "$real" in
+    "$PROJECT_ROOT"/*|"$PWD"/*|./*)
+      echo "TOOLCHAIN_SHADOWED tool=$tool path=$real (fail-closed)" >&2
+      fail=1; continue ;;
+  esac
+
+  # Opt-in allowlist: in prod the tool MUST live under a trusted system dir.
+  if [[ -n "${CASAN_TOOLCHAIN_TRUSTED_DIRS:-}" ]]; then
+    ok=0
+    for pfx in "${TRUSTED[@]}"; do
+      [[ -n "$pfx" ]] || continue
+      case "$real" in "$pfx"/*) ok=1; break ;; esac
+    done
+    if [[ "$ok" -ne 1 ]]; then
+      echo "TOOLCHAIN_UNTRUSTED_PATH tool=$tool path=$real (not under CASAN_TOOLCHAIN_TRUSTED_DIRS)" >&2
+      fail=1
+    fi
+  fi
+done
+
+if [[ "$fail" -eq 0 ]]; then
+  echo "TOOLCHAIN_OK tools=${#REQUIRED[@]}"
+  exit 0
+fi
+exit 1