test(suites): seed security/slow/integration suites via measured retags

Renames (git mv) with all references updated (ci-test-scope RULES,
windows-parity allowlist, test-file-count allowlist, docs in 6 locales):

- 5 scanner tests -> *.security.test.cjs — the 'Run security tests' CI step
  ran zero files since the suite taxonomy landed; it is now honest.
- graphify-auto-update -> *.slow.test.cjs (36s, slowest file in the suite;
  e2e gsd-tools spawns) — runs on full-matrix lanes and push to next.
- installer-migration-install-integration -> *.integration.test.cjs
  (13s; an integration test by its own name).

Coverage gate measured after retags: 88.55% lines (gate 70%).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/FEATURES.md

@@ -1293,7 +1293,7 @@ PreToolUse hook that scans Write/Edit calls targeting `.planning/` for injection
 **3. Workflow Guard Hook** (`gsd-workflow-guard.js`)
 PreToolUse hook that detects when Claude attempts file edits outside a GSD workflow context. Advises using `/gsd-quick` or `/gsd-fast` instead of direct edits. Configurable via `hooks.workflow_guard` (default: false).
 
-**4. CI-Ready Injection Scanner** (`prompt-injection-scan.test.cjs`)
+**4. CI-Ready Injection Scanner** (`prompt-injection-scan.security.test.cjs`)
 Test suite that scans all agent, workflow, and command files for embedded injection vectors.
 
 **Requirements:**