Covers gsd-security-auditor agent, secure-phase command/workflow,
SECURITY.md template, config defaults, VALIDATION.md columns, and
threat-model-anchored behaviour assertions.
Also fixes copilot-install.test.cjs expected agent list to include
gsd-security-auditor — hardcoded list was missing the new agent.
All 1500 tests pass, 0 failures.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
