test(#4519): migrate security-scanner batch to named timeout constants

Batch 8 of 17 in the ad hoc timeout literal migration (epic #4445).
Replaces every bare numeric timeout/timeoutMs object-literal property in
tests/secret-scan-lint.security.test.cjs, tests/security-scan.security.test.cjs,
tests/security-prompt-injection.security.test.cjs, tests/prompt-injection-scan.security.test.cjs,
tests/read-injection-scanner.security.test.cjs, tests/read-injection-scanner.property.test.cjs,
and tests/security.test.cjs with a named constant, per
eslint-rules/no-adhoc-timeout-literal.cjs. Removes the 7 files from the
rule's allowlist.

The issue guessed this batch "most likely needs its own named
SCAN_TIMEOUT_MS." Reading every one of the 19 call sites directly found a
more specific picture: 8 sites across 3 files scan exactly one small temp
fixture file and match the existing QUICK_SPAWN_TIMEOUT_MS class exactly
(reused, no new constant). Two new shared constants cover genuinely
distinct classes that happen to coincide in value:
SCAN_USAGE_ERROR_TIMEOUT_MS (a bash scan script given missing arguments)
and MALFORMED_INPUT_HOOK_TIMEOUT_MS (a Node hook fed malformed JSON) --
kept as separate names per this migration's standing rule that numeric
coincidence is never identity. Three file-local constants cover a real
multi-file directory scan, a property-fuzzing safety net, and a
path-traversal hook test, each with its own pre-existing rationale
preserved.

No bound is lowered or raised anywhere in this batch, honoring the
issue's explicit caution that security-scan timing margins deserve
extra scrutiny. No src/bin file touched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/security.test.cjs

@@ -654,10 +654,19 @@ describe('validateFieldName', () => {
 
 const { runHook: runHookSeam } = require('./helpers/process-seam.cjs');
 
+// Bounds a single advisory hook invocation (gsd-context-monitor.js or
+// gsd-statusline.js) under a session_id path-traversal security test —
+// trivial synchronous work, no subprocess fan-out, expected near-instant
+// silent exit. The value (3000ms) is the tightest bound in this migration's
+// security-scanners batch and unique to this file/class; preserved exactly,
+// not widened to match any other existing norm. No fresh bench data
+// justifies a different number.
+const SESSION_ID_TRAVERSAL_HOOK_TIMEOUT_MS = 3000;
+
 function runHook(hookPath, inputJson) {
   const result = runHookSeam(hookPath, [], {
     input: JSON.stringify(inputJson),
-    timeoutMs: 3000,
+    timeoutMs: SESSION_ID_TRAVERSAL_HOOK_TIMEOUT_MS,
   });
   return { exitCode: result.exitCode, stdout: result.stdout, stderr: result.stderr };
 }