Would You Merge a Security Fix From Gemini 4 Carbon Without This Test?

The fix looked right at a glance. It made a random 16-byte salt and used PBKDF2, a slow password hash. A reviewer skimming it in a pull request might have approved it. It still failed its test. The ne