security: publish hardened v1 initiative snapshot

Publish the reviewed security policy and evidence, exact runtime ABI enforcement, orphan-output and permission safeguards, dead-upstream cleanup, and the evidence-gated v1 launch plan.

This commit is an exact sanitized export from the private development record. Material implementation and review were assisted by OpenAI Codex; Cole Speelman reviewed the changes and accepts human responsibility.

Himesan-Output-Permission: v1.0
Signed-off-by: Cole Speelman <gamertan@noreply.localhost>

internal/devserver/proxy_test.go

@@ -250,6 +250,26 @@ func TestWaitingPageConnectsToEvents(t *testing.T) {
 	}
 }
 
+func TestClearTargetOnlyClearsSelectedUpstream(t *testing.T) {
+	t.Parallel()
+	proxy := newDevelopmentProxy(newEventHub())
+	if err := proxy.setTarget("127.0.0.1:7001"); err != nil {
+		t.Fatal(err)
+	}
+	if proxy.clearTarget("127.0.0.1:7002") {
+		t.Fatal("clearTarget cleared a different selected upstream")
+	}
+	if target := proxy.target.Load(); target == nil || target.Host != "127.0.0.1:7001" {
+		t.Fatalf("selected upstream changed unexpectedly: %v", target)
+	}
+	if !proxy.clearTarget("127.0.0.1:7001") {
+		t.Fatal("clearTarget did not clear the selected upstream")
+	}
+	if target := proxy.target.Load(); target != nil {
+		t.Fatalf("selected upstream remains after clear: %v", target)
+	}
+}
+
 func TestDevelopmentProxyRequiresLocalAuthorityAndSameOrigin(t *testing.T) {
 	t.Parallel()
 	var upstreamRequests atomic.Int32