docs(security): posture write-up + presentation script + (optional) blog outline

docs/demo-recording-plan.md

@@ -34,6 +34,7 @@ Already on disk under different names? Rename in-place; nothing in this doc refe
 | # | Recorded | Title | Length (rough) | Local filename | YouTube URL | Script that produced it |
 |---|----------|-------|----------------|----------------|-------------|--------------------------|
 | S1 | Sat 22:54 | CoT Track Injection Demo — 3 scenarios (unsigned reject / tampered reject / signed accept) | ~60-90s | `2254-security-cot-inject-demo.mp4` *(currently on Satriyo's laptop as `satriyo_demo_security_1.mp4` — rename when moving into `docs/demo-clips/`)* | TBD | `security/cot_inject_demo.py` ・ `make inject-demo` |
+| S6 | TBD | Model Supply-Chain Integrity — `make model-integrity` happy path (4 Piper voice configs + Gemma manifest verified) → mutate one byte of `models/piper/en_US-ryan-high.onnx.json` → re-run, show red FAIL with expected/actual hash diff. ~20s total. | ~20s | `<HHMM>-security-model-integrity.mp4` *(not yet recorded — capture during Sun 0700-0900 alongside other security re-runs)* | TBD | `make model-integrity` ・ `security/model_integrity.py` (issue #57, PR #100) |
 | S2 | Sat 22:59 | Attack-Vector Rejection — 5 regression tests (issue #25) | ~45-60s | `2259-security-attack-vector-rejection.mp4` *(was `satriyo_security_demo_2.mp4`)* | TBD | `security/test_security_regressions.py` ・ `pytest security/test_security_regressions.py -v` |
 | S3 | Sat 23:00 | Sign Benchmark — 1000 ML-DSA-65 round-trips, 0.128 ms avg (39× under PRD §11.2 target) | ~30-45s | `2300-crypto-sign-bench.mp4` *(was `satriyo_security_demo_3.mp4`)* | TBD | `crypto/sign_bench.py` ・ `make sign-bench` |
 | S4 | Sat 23:02 | Security Scan — Bandit + pip-audit clean across all lanes | ~30-45s | `2302-security-scan.mp4` *(was `satriyo_security_demo_4.mp4`)* | TBD | `make security` |