Report via GitHub private vulnerability reporting. Include the Marlin version and a minimal repro.

Priority concerns:

• admission bypass (proposals admitted past the cache budget)
• plan hash collisions weakening replay auditing
• draft endpoint confusion (wrong draft serving a request)