docs: record structured privacy audit evidence

docs/content-approval-checklist.md

@@ -75,9 +75,12 @@ Evidence refreshed: 2026-09-05 compiled-preview acceptance.
   results, and limitations while its rights-unconfirmed frame remains omitted.
   Opinion Dynamics remains a supporting project.
 - The public asset manifest, prepared publication tree, content references, and
-  compiled output close exactly at 15 records/files. Metadata, barcode/QR,
-  binary denylist, and image-text privacy checks passed without exposing the
-  private inputs used by those checks.
+  compiled output close exactly at 15 records/files. All three raw structured
+  surfaces passed the same normalized substring scanner with a 199-entry
+  sensitive projection of the 366-entry denylist after removing 167 frozen,
+  exact approved-public overlaps; valid canary mutations of both JSON surfaces
+  and compiled HTML were rejected. Metadata, barcode/QR, binary, and image-text
+  privacy checks also passed without exposing private inputs or terms.
 - Page title/description, canonical and social metadata, `rel="me"` profile
   links, and both email actions were verified. No downloadable CV or other
   unapproved document is published.