Evidence, Not Intent: What Your JST Will Want to See in Your AI-Cyber Action Plan