The HTML/PDF report had no visual identity (no logo) and no sharing classification. Embeds the Guará logo as a base64 data URI (so the standalone export still renders offline, same approach as Sabiá's report) and adds a TLP:AMBER badge next to the existing "Uso autorizado" one — forensic recovery findings are sensitive and worth marking for limited disclosure, same as any other Ciberfauna report. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>