Pentest remediation evidence (BB-DEEPDIVE-2026-001)

Evidence recordings for the BB-DEEPDIVE-2026-001 pentest remediation PRs.

Each file is a real screencast (Chrome DevTools Page.startScreencast, driven by real input events) of one control being attacked on its own base branch, refused on the PR, and the legitimate paths re-checked afterwards. Recorded against a live stack: PostgreSQL 16, Redis, the clairvoyance API and the loom dashboard.

Not for release consumption — this tag exists only to host the recordings so they can be linked from the PRs.