[FEATURE] Official canary test to confirm CVP is active for the current org and model

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

There is no way to check from inside Claude Code whether CVP is actually active for the org and model I'm using right now. The only signals today are the approval email and the portal, and neither tells me whether the session in front of me gets the CVP treatment. Approval is tied to one org ID, coverage differs by model and the status can change (several open issues report approvals rolling back to "In review"). So the first time I find out is when real work gets blocked mid-task.

Proposed Solution

An official canary, like the EICAR test file for antivirus: a fixed, harmless input that is guaranteed to be blocked by the cyber safeguard without CVP and guaranteed to pass with CVP. A small command that runs it against the current org and model and prints "CVP active" or "CVP not active" would be ideal.

Alternative Solutions

Showing the CVP status for the current org and model in /status would also solve it. Today I compare the org ID in ~/.claude.json against the approval email by hand, which only tells me the org matches, not that CVP actually applies.

Priority

Medium - Would be very helpful

Feature Category

API and model interactions

Use Case Example

1. I start a security triage session on a new machine or after switching accounts.
2. I run the canary check.
3. It says CVP is not active, so I fix the account or model before starting, instead of getting blocked halfway through a report.

Additional Context

Related reports where CVP-approved users could not tell whether approval applied: #84352, #84689, #85222, #91566, #93224.