fix(#1626): make the security gate severity-aware via per-threat severity (#1635)

workflow.security_block_on was documented as the minimum threat severity
that blocks advancement, but threats carried no severity and the auditor's
threats_open count (the SECURITY.md gate field) counted every open threat
regardless of severity — so the threshold had no effect, and the auditor's
block_on vocabulary (open/unregistered/none) did not even match the config
enum (critical/high/medium/low/none).

- planner: add a Severity column to the STRIDE threat register; assign
  severity per threat.
- auditor: read severity; reconcile the <config> block_on domain to the
  severity enum; redefine threats_open as the count of OPEN threats whose
  severity is at or above block_on (none => 0). Below-threshold opens are
  reported as non-blocking and excluded from threats_open.
- SECURITY.md template + planning-config.md reconciled.

No gate-check site changed: threats_open == 0 stays the gate everywhere;
only its computation is now severity-filtered.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

tests/workflow-size-baseline.json

@@ -65,7 +65,7 @@
   "resume-project.md": 17226,
   "review.md": 39404,
   "scan.md": 7688,
-  "secure-phase.md": 13315,
+  "secure-phase.md": 13476,
   "session-report.md": 4044,
   "settings-advanced.md": 39666,
   "settings-integrations.md": 15848,