feat: add a dedicated Security Auditor agent with veto power

Security was one section among seven in the QA Engineer. That is structurally
weak: the agent that wants to recommend "production ready: YES" also judged
security, and as a subsection it competes for attention with acceptance
criteria, regression and test authoring.

The new agent:
- has no Write/Edit tools, so "never fix what you find" is enforced by the tool
  list rather than by instruction — it cannot launder a finding into a patch
- reports PASS / FAIL / UNVERIFIED, and UNVERIFIED must reach the spec; an audit
  that omits what it could not check reads as all-clear
- audits against .claude/rules/security.md, the same standard the developer
  agents are held to, so every mandatory item gets a verdict
- holds a veto: BLOCK stops /deploy regardless of functional test results

/qa now runs both agents in parallel and keeps the verdicts separate. The QA
Engineer is explicitly forbidden from speaking for security.

CLAUDE.md

@@ -52,7 +52,7 @@ scripts/update.sh   Pull, rebuild, restart, roll back on failure
 | 3 | `/architecture` | Tech design inside the spec |
 | 4 | `/frontend` | UI components |
 | 5 | `/backend` | APIs, data layer, auth |
-| 6 | `/qa` | Test results inside the spec |
+| 6 | `/qa` | Test results inside the spec — runs the QA Engineer **and** the Security Auditor, which holds a veto |
 | 7 | `/deploy` | Live Docker Compose stack |
 
 `/refine PROJ-X` reopens an existing spec. `/help` reports where the project stands.