Add P0 negative tests, prod bundle forbidden-string scan, and the Phase 0 security止血 acceptance report with PASS results.