Security Hardening

Canonical model: docs/security-model.md.

• Deny privileged operations by default when security subsystems are enabled
• Require signed config in production
• Bounded queues / anti-replay caches
• No shell exec by default
• Run shiftlock security scan -production in CI

See also Threat Model and the Production Checklist.