HN-2026-002 PoC v2: updatePost coAuthor bypass

Demonstrates unauthorized co-author attribution via updatePost — no team pub required.