v2026.08.07.02 – v2026.08.07.03 — 2026-08-07

• fix(security): resolve 6 bugs found by round-2 adversarial review
• fix(security): quota-bypass + errordoc path traversal (round-2 retry)