feat: add security finding lifecycle

[solomonneas]

Summary

• add brigade security review for latest evidence bundle inspection
• add reasoned brigade security suppress and brigade security unsuppress
• warn in brigade doctor and brigade work doctor for stale suppressions and missing suppression reasons
• add roadmap note for a later issue/TDD work loop

Verification

• .venv/bin/python -m pytest tests/test_security_cmd.py tests/test_doctor.py::test_doctor_warns_on_stale_security_suppressions tests/test_work_cmd.py::test_work_doctor_warns_on_stale_security_suppressions -q
• .venv/bin/python -m pytest tests/test_work_cmd.py::test_work_doctor_fails_invalid_security_config tests/test_security_cmd.py tests/test_doctor.py::test_doctor_fails_invalid_security_config tests/test_doctor.py::test_doctor_warns_on_stale_security_suppressions -q
• .venv/bin/python -m pytest -q
• PYTHONPATH=$HOME/repos/content-guard/src python3 -m content_guard scan . --policy $HOME/repos/content-guard/policies/public-repo.json
• live temp repo security lifecycle smoke verified scan, review, suppress, rescan, unsuppress, and config cleanup