fix(demo): print the attack-case fields that were actually observed

The RC security card rendered `http undefined · worker 12` for the flood case,
which records no status, and repeated its bare status for the malformed case,
which records no provider call. Both read as a broken card rather than the
measurement it is. Build each row from the observed fields that exist and leave
the rest out.

scripts/record_release_demo.mjs

@@ -1195,11 +1195,18 @@ const securityReport = securityRun.report;
 if (securityReport.cases.length < 8) throw new Error('the RC attack suite must run every named abuse class');
 await tap('[data-view="home"]', 450);
 const caseDetail = (item) => {
-  const observed = item.observed || {};
-  if ('providerCalls' in observed) return `http ${observed.status} · worker ${observed.providerCalls}`;
-  if ('refused' in observed) return `refused ${observed.refused}`;
-  if ('imageBytesInLog' in observed) return `image bytes ${observed.imageBytesInLog}`;
-  return item.status;
+  const observed = item.observed === null || typeof item.observed !== 'object' ? {} : item.observed;
+  // Print each observed field the case actually recorded. A case with no `status` used to render
+  // `http undefined` on camera, and one with no `providerCalls` rendered its status twice — both read
+  // as a broken demo instead of the measurement it is.
+  const parts = [];
+  if ('status' in observed) parts.push(`http ${observed.status}`);
+  if ('refused' in observed) parts.push(`refused ${observed.refused}`);
+  if ('providerCalls' in observed) parts.push(`worker ${observed.providerCalls}`);
+  if ('providerTextLeaked' in observed) parts.push(`text leaked ${observed.providerTextLeaked}`);
+  if ('repeatedAnswerIdentical' in observed) parts.push(`identical ${observed.repeatedAnswerIdentical}`);
+  if ('imageBytesInLog' in observed) parts.push(`image bytes ${observed.imageBytesInLog}`);
+  return parts.length ? parts.join(' · ') : item.status;
 };
 const securityRows = [
   ['command', 'node scripts/security_attack_suite.mjs'],