security: publish hardened v1 initiative snapshot

Publish the reviewed security policy and evidence, exact runtime ABI enforcement, orphan-output and permission safeguards, dead-upstream cleanup, and the evidence-gated v1 launch plan.

This commit is an exact sanitized export from the private development record. Material implementation and review were assisted by OpenAI Codex; Cole Speelman reviewed the changes and accepts human responsibility.

Himesan-Output-Permission: v1.0
Signed-off-by: Cole Speelman <gamertan@noreply.localhost>

sando/component_test.go

@@ -12,6 +12,13 @@ import (
 	"gamertan.com/sandwich-hime/sando"
 )
 
+func TestRuntimeABIMarker(t *testing.T) {
+	t.Parallel()
+	if sando.ABISandoV1 != "sando.v1" || sando.ABI != sando.ABISandoV1 {
+		t.Fatalf("runtime ABI=%q marker=%q", sando.ABI, sando.ABISandoV1)
+	}
+}
+
 func TestRender(t *testing.T) {
 	t.Parallel()