That's an interesting, unconventional (double vane) steering method. Does it ever get caught with the rotor in a downwind position? It would seem like it could. Downwind designs sometimes had issues with this, when the wind stopped in one direction and came up in the opposite (180 deg) direction.
It also looks like there are tips brakes on the blades in the photo, or are those spoilers of some sort?
I don't know that I'd ever claim something to be tornado proof even if I thought it were. I'm probably superstitious, but it would seem to challenge Mother Nature in rather defiant way ;>]. In news coverage of such events, it seems everything in the path is destroyed.
It does seem to me that, in your list of five, that you are missing at least two or three proven methods of control and/or shutdown: manual or power furling, and automated blade pitching/feathering like what Midwoud has illustrated here. I think the other method is a motorized yaw, but this is usually in conjunction with blade pitch designs.
The double vane was only tested for an upwind rotor. It had two square vane blades size 0.5 * 0.5 m mounted at both ends of a six m long pipe under an angle of 20° with the rotor shaft. A square vane blade has about a linear Cn-alpha curve for alpha in between 0° and 40° (see figure 5 report KD 551) and the vane therefore accepts variations of the wind direction of 20° without stalling of one of the vane blades. The head bearing was a big one row ball bearing of a trailer with very little friction and the vane was therefore turning the head in the wind for very low wind speeds.
The 3-bladed rotor had a diameter of 4 m and a design tip speed ratio of 6. However, the generator housing was empty and the rotor was therefore running unloaded. The blade tips were provided with elastic air brakes made out of 1 mm stainless spring steel. The air brakes bend more to the outside as the rotational speed is higher. A scale model of the rotor with a diameter of 1.8 m was tested in the wind tunnel also with elastic air brakes. It appeared in the wind tunnel, that the air brakes were very effective in reduction of the Cp at increasing wind speeds. The braking effect on the real rotor was also effective but the rotor was very noisy at high rotational speeds. It sounded like if a helicopter was flying over. This was the reason why the idea finally was cancelled.
In my report KD 485, I describe five different systems which turn the rotor out of the wind; three around a vertical axis and two around a horizontal axis. There are more systems but those are less common. Pitch control is another way but pitch control is not turning the rotor out of the wind and is therefore described in several other KD reports (see for report numbers note "Sequence of KD-reports for self-study" at the top of the list with KD-reports).
Turning the rotor out of the wind manually is no safety system as it isn't working automatically. Anything with a motor to turn the rotor out of the wind isn't fale-safe as it fails if the energy needed for the motor is gone or if anything in the steering of the motor fails. I prefer only systems which are directly steered by the rotor thrust or by the rotational speed.
Big wind turbines have pitch control systems steered by several different signals like wind speed, rotational speed, vibrations and power and regulated by a computer but several big accidents have happened because of a fail somewhere in the circuit resulting in an unloaded rotor turning at extremely high rotational speeds.