Security events

Many critical events here are expected, from earlier smoke tests and gate checks. A critical label means a dangerous action was attempted and blocked — it does not mean the action succeeded or that the system is under attack. Fail-closed blocking is working as designed.