[Bug] Safety classifier blocks authorized security testing of own systems

Bug Description
▎ Safety classifier blocks defensive boot-security testing of our own OS
▎
▎ We're building CumClave OS (Fedora Atomic bootc, a signed UKI, LUKS2 with TPM2+PIN). Before release, our test plan requires proof that the disk key cannot be released when someone boots our signed image against a decoy root, for example from a USB stick. The tests run only on copies of our own throwaway test VM, with the originals hashed, a security reviewer approving every step, and no production keys involved.
▎
▎ The safety classifier blocked these cases in several agent sessions and models, and also stopped a reply that only listed the commands from our own approved design document. The first case (N9(c)) passed earlier the same day; the remaining cases are blocked. This is defensive verification of our own product's disk encryption, and without it we can't responsibly ship. We'd appreciate a path for authorized security testing of our own systems.

Environment Info

• Platform: linux
• Terminal: tmux
• Version: 2.1.292
• Feedback ID: 3a013892-5ebe-40f5-a5c8-723678f42cbd