fix(#2119): single SECURITY.md writer — auditor is return-only (#2154)

* fix(2119): single SECURITY.md writer — auditor is return-only

The gsd-security-auditor held Write/Edit and was instructed to write
SECURITY.md (no <N>- prefix, no template frontmatter), while the
orchestrator's Step 6 also wrote the correct padded <N>-SECURITY.md
from templates/SECURITY.md. Two writers, two naming conventions, two
shapes — the auditor's unprefixed file was invisible to the workflow's
*-SECURITY.md glob detector and unparseable for the threats_open gate.

Fix (option 1 from the issue): make the auditor return-only.
- Remove Write/Edit from auditor's tools
- Rewrite all 'Write SECURITY.md' instructions to 'Return structured
  verdict' with threats_open count
- Add explicit constraint in workflow Step 5 spawn prompt
- Update existing test (was asserting Write in tools — now asserts absence)
- Add new regression test for single-writer contract
- Update docs/AGENTS.md stale Tools/Produces rows
- Regenerate golden fixtures + agent size baseline

* docs(changeset): backfill PR number (#2154)

* chore(#2119): regenerate pi/qwen golden fixtures after next merge

The single-writer change edits gsd-core/workflows/secure-phase.md and
agents/gsd-security-auditor.md; pi.json (added on next) and qwen.json (merge
straggler) were the only runtime fixtures still holding pre-change hashes for
those files. All other runtimes already reflect the change. Regenerated via
the sanctioned gen-golden-install-parity script.

* merge origin/next — regenerate goldens + baseline for merged state

* fix slash-command syntax: /gsd-secure-phase → /gsd:secure-phase (#2154 CI fix)

tests/fixtures/golden-install-parity/opencode.json

@@ -29,7 +29,7 @@
   "agents/gsd-project-researcher.md": "dae210ae0b3c6e2b",
   "agents/gsd-research-synthesizer.md": "e02c6ad5d1b74171",
   "agents/gsd-roadmapper.md": "1658a40b20d8b575",
-  "agents/gsd-security-auditor.md": "e36e436c0d5c26d5",
+  "agents/gsd-security-auditor.md": "64aa435793af52ec",
   "agents/gsd-ui-auditor.md": "e810012e685b2466",
   "agents/gsd-ui-checker.md": "4f88fd4c9d4c56a3",
   "agents/gsd-ui-researcher.md": "ecb617901cb7ad06",
@@ -358,7 +358,7 @@
   "gsd-core/workflows/resume-project.md": "ad9f06a10bab8cc0",
   "gsd-core/workflows/review.md": "2d28a6683ff587de",
   "gsd-core/workflows/scan.md": "ad8ebcad4626d4a8",
-  "gsd-core/workflows/secure-phase.md": "e9a488cec3b4efdc",
+  "gsd-core/workflows/secure-phase.md": "71e6e689e80288ec",
   "gsd-core/workflows/session-report.md": "2e5b1205324ddefa",
   "gsd-core/workflows/settings-advanced.md": "252b0d3edc315339",
   "gsd-core/workflows/settings-integrations.md": "d1711a95f44fdbde",