feat(llm-security)!: v8 Phase 3 complete - riskScoreV1, posture heuristic, docs

Closes Phase 3 (B11) of the v8.0.0 plan. Three parts, all with the failing
test written first.

riskScoreV1 removed. scanners/lib/severity.mjs drops riskScoreV1() and its
SEVERITY_WEIGHTS_V1 table - @deprecated since v7.0.0, kept for diff/comparison,
zero callers in code or tests (re-verified, not taken from the plan). The v1
weights are recorded in CHANGELOG so an old score stays re-derivable. riskScore
(v2) is untouched; a test pins that one critical still lands in the 70-95 tier
and that 50 lows score below it, which is exactly the case v1 collapsed to 100.

Posture category 12 no longer keys off an identifier name. The check was
/TRIFECTA_MODE/i over the session-guard source, which measured what a constant
was CALLED rather than whether enforcement was configurable. With the env-var
gone, that regex would have dropped every correctly-migrated project from PASS
to PARTIAL - the gate punishing the migration it exists to encourage. It now
matches getPolicyValue('trifecta', 'mode', ...) and still accepts a pre-v8
vendored guard reading the old env-var, because a third-party project carries
its own hook copy and is equally configurable either way; the evidence line
says which of the two was found. The PARTIAL finding recommended setting an
env-var that v8 ignores; it now names the policy key. The grade-a fixture hook
moves to the policy-era form.

Two never-implemented env-vars deleted from the docs. LLM_SECURITY_SCR_OFFLINE
(ci-cd-guide) and LLM_SECURITY_OFFLINE (supply-chain-attack example) were
documented as OSV.dev / npm-audit kill-switches. No code has ever read either -
verified by grep across scanners, hooks and scripts, which finds them only in
markdown. A promised kill-switch that does nothing is worse than a documented
absence: it is trusted precisely when the run is meant to be air-gapped. The
docs now say there is none and that egress must be blocked at the network
layer. The LLM_SECURITY_AUDIT_* wildcard is narrowed to the one real key.

Docs. Migration section in README + CHANGELOG with the env-var -> policy-key
table, the detection commands (env + shell rc + .envrc + workflows), and the
explicit warning that a removed variable is now INERT rather than an error -
which is the failure mode that loses a project its configuration silently. The
hardening-guide env table splits into surviving vars and a removed-vars
migration table; its "promote to block" runbook named two variables that no
longer exist. Also swept: CLAUDE.md hook table, scanner-reference, ci-cd-guide,
both lethal-trifecta example docs, mitigation-matrix, injection-research.

Test counts in README/CLAUDE.md synced 2034 -> 2045.

Suite 2045 tests, 0 fail (2039 + 4 posture-trifecta + 2 riskScoreV1). The two
known parallel-load flakes did not recur this run.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BB4vXvwvtW4dxbPRd6vsez

examples/lethal-trifecta-walkthrough/README.md

@@ -58,7 +58,7 @@ preview after step 3.
 
 - **`hooks/scripts/post-session-guard.mjs`** — the only hook invoked.
   Configurable via `policy.json` `trifecta.mode` (`block` / `warn` /
-  `off`; default `warn`) or env var `LLM_SECURITY_TRIFECTA_MODE`.
+  `off`; default `warn`) in `.llm-security/policy.json`.
 
 This example uses `mode: warn` (default). In `block` mode the third
 call's advisory becomes a hard block (exit 2) and the agent action is
@@ -92,7 +92,7 @@ in a `finally` block before exiting. **Your real session state under
   Jensen-Shannon divergence, or volume-threshold advisories.
   Those have their own unit tests under `tests/lib/post-session-guard.*`.
 - This is deterministic detection. It does not exercise the
-  `block`-mode exit-2 path — flip `LLM_SECURITY_TRIFECTA_MODE=block`
+  `block`-mode exit-2 path — set `"trifecta": {"mode": "block"}`
   and re-run if you want to see the script fail at step 3.
 
 ## See also

examples/lethal-trifecta-walkthrough/expected-findings.md

@@ -20,7 +20,7 @@ The `systemMessage` payload from step 3 must contain:
 - The literal phrase `Rule of Two violation`
 - A list of evidence items under `Untrusted input:`, `Data access:`,
   `Exfil sink:` headings
-- A reference to `Set LLM_SECURITY_TRIFECTA_MODE=` for configuration
+- A reference to the `trifecta.mode` policy key for configuration
 - An OWASP tag mentioning `ASI01` or `ASI02`
 
 Optional (depending on detail string and `policy.json` config):
@@ -32,7 +32,7 @@ Optional (depending on detail string and `policy.json` config):
 
 ## Audit-trail side effect
 
-When `LLM_SECURITY_AUDIT_LOG` (or `policy.json` `audit.log_path`) is
+When the `policy.json` key `audit.log_path` is
 set, step 3 writes a JSONL event:
 
 ```json
@@ -48,7 +48,7 @@ set, step 3 writes a JSONL event:
 
 The walkthrough does not configure the audit log — `writeAuditEvent`
 no-ops when no path is set. To observe the audit-trail behaviour,
-re-run with `LLM_SECURITY_AUDIT_LOG=/tmp/trifecta-audit.jsonl`.
+re-run with `"audit": {"log_path": "/tmp/trifecta-audit.jsonl"}` in `.llm-security/policy.json`.
 
 ## State file