“During 1,700 hours of red-teaming, no attack on the Constitutional Classifiers++ system successfully elicited responses to all eight target queries with detail comparable to an undefended model.”