security: phase D pre-release review — pass; harden saslpasswd2 argv

Fable review of the full diff from the v1.0 audit (Phase 11, bd64e80) to
HEAD plus a complete pass over the docs/security.md checklist (former spec
7.6). No exploitable findings. One defence-in-depth fix: the application
login is passed to saslpasswd2 behind a -- end-of-options marker so a
login starting with - can never be parsed as a flag. Accepted risks
unchanged; plan § D closed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,16 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Security
+
+- Pre-release security review (plan § D, model Fable, 2026-08-06): full pass
+  over the diff from the v1.0 audit (Phase 11, `bd64e80`) to HEAD plus the
+  complete spec 7.6 checklist. No exploitable findings; one defence-in-depth
+  fix below. Accepted risks in `docs/security.md` unchanged.
+- `saslpasswd2` argv: the application login is now passed after a `--`
+  end-of-options marker (`internal/app/sasl.go`), so a login starting with
+  `-` (legal under the whitelist) can never be parsed as a flag by getopt.
+
 ### Added
 
 - docs: `docs/code-review.md` — phase 1.5 plan for optional password encryption