fix(security): promote boundary policy refinements to prod

[allenwoods]

Summary

Promote the reviewed public-boundary policy refinements from the default branch to prod before the large current-tip cleanup.

Includes only:

• fix(security): refine public boundary false positives #197 false-positive refinements with exact whole-file hash pins
• fix(security): keep boundary guard self-clean #198 self-scan-safe test literals

Verification

• Independent static review found no P0/P1/P2 after refinement
• 53 public-boundary tests passed on the source branch
• latest default tip: b87b90fe0f2cfefd6a143eee2f033a3da71f54ed

Expected policy behavior

This is a policy-bootstrap PR. It changes the protected guard itself, and its candidate tip is intentionally still the pre-cleanup public tree. The trusted scan therefore reports both the guard change and the existing private-content findings. Any merge is an explicit, audited administrator exception limited to installing the reviewed policy before the separate cleanup PR.

The following cleanup PR must pass the trusted policy normally; this exception must not be reused for content changes.

Deployment

No deployment. Do not run redeploy.sh. Do not run rsync --delete.