A large amount of the initial 12.5million coins are staked in the prime controllers. This weight is what gives these special nodes authority for the transaction's authenticity. There are 50 prime controllers staked with at least 1% of all available coins. The rest of the coins are now in the hands of the former hashlet owners' wallets, and the last little bit are being mined now... and floating around on exchanges.
So... no... GAW doesn't control 96% of the hashrate or the stake rate.
It sounds to me that you just described a 51+ scenario. They control at least 50% in Prime Controllers and then a significant amount in ZenCloud accounts.
Yeah, I don't see any built-in security against a 51% attack specifically in the code. But the attack still requires collusion between a majority of prime controllers, and a bad actor(s) can be ejected from the network. All it takes is one prime to call a vote for ejection. So theoretically, GAW (or the collusion group) would have to own 100% of the prime controllers. After the ejection, Orion controllers can bid to become prime, thereby also securing against collusion.