After the Drupal Gin Patch: Preventing CVE-2026-110738 Regressions

Post-update controls that keep CVE-2026-110738 from returning through dependency or permission drift.