fix(#1627): scale security rigor by ASVS level (planner disposition + auditor depth) (#1636)

workflow.security_asvs_level was display-only — the planner hardcoded
'mitigate if ASVS L1 requires it' and the auditor only echoed the level,
so L2/L3 behaved identically to L1.

- New reference gsd-core/references/security-asvs-levels.md defines L1
  (opportunistic), L2 (standard), L3 (comprehensive) for both planner
  threat disposition and auditor verification depth (higher = superset).
- planner: disposition now scales with the configured ASVS level (no
  hardcoded L1) + @-pointer to the reference.
- auditor: verification depth scales with asvs_level (L1 grep-presence,
  L2 boundary/vector check, L3 end-to-end trace + bypass check).
- planning-config.md + INVENTORY updated; planner kept under its 48K cap
  by extracting the goal-backward worked example to planner-guidance.md.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

tests/agent-size-baseline.json

@@ -23,11 +23,11 @@
   "gsd-pattern-mapper.md": 12487,
   "gsd-phase-researcher.md": 40638,
   "gsd-plan-checker.md": 44646,
-  "gsd-planner.md": 49306,
+  "gsd-planner.md": 47865,
   "gsd-project-researcher.md": 22014,
   "gsd-research-synthesizer.md": 13653,
   "gsd-roadmapper.md": 22183,
-  "gsd-security-auditor.md": 6226,
+  "gsd-security-auditor.md": 6767,
   "gsd-ui-auditor.md": 17159,
   "gsd-ui-checker.md": 11088,
   "gsd-ui-researcher.md": 19272,