test(suites): seed security/slow/integration suites via measured retags

Renames (git mv) with all references updated (ci-test-scope RULES,
windows-parity allowlist, test-file-count allowlist, docs in 6 locales):

- 5 scanner tests -> *.security.test.cjs — the 'Run security tests' CI step
  ran zero files since the suite taxonomy landed; it is now honest.
- graphify-auto-update -> *.slow.test.cjs (36s, slowest file in the suite;
  e2e gsd-tools spawns) — runs on full-matrix lanes and push to next.
- installer-migration-install-integration -> *.integration.test.cjs
  (13s; an integration test by its own name).

Coverage gate measured after retags: 88.55% lines (gate 70%).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/explanation/security-model.md

@@ -158,7 +158,7 @@ injected instructions in untrusted content — catching cases where an attacker
 has embedded instructions in a file that GSD is about to incorporate into an
 agent's context.
 
-**CI scanner.** `prompt-injection-scan.test.cjs` scans all agent, workflow,
+**CI scanner.** `prompt-injection-scan.security.test.cjs` scans all agent, workflow,
 and command files for embedded injection vectors as part of the test suite.
 This catches injection attempts in the GSD source itself — for example, a
 supply-chain attack that modified a workflow file to add a role-override