* test(e2e): make security boundary tests assert real outcomes * fix(e2e): use expect_err to satisfy clippy err_expect lint