fix: the second lekerepo trial's faults that made a result wrong or misleading

voyage-lekerepo trial 2 (2026-10-08), report section A; the operator decided
they are fixed before the next release:
- A1: a /code-review finding whose category is simplification, efficiency,
  style or readability enters as CODE_REVIEW_IMPROVEMENT (MINOR), not MAJOR.
- A2: recommended_action is the engine's own fix when transcribed, otherwise
  a test-first step; never the failure scenario dressed as a remedy.
- A3: a /code-review finding outside the exact range it was given is declined
  and listed, but no longer holds ALLOW back; /security-review's still does.
- A4: the manifest must_contain recipe uses grep -E -e ... -- so a pattern
  like --sep is not read as an option.
- A5: indented sub-points belong to their criterion (counted), and a
  criterion with sub-points and no command warns BRIEF_SC_SUBPOINTS.
- A6: a brief requiring bash 3.2 whose criterion runs plain bash warns
  BRIEF_SC_BASH_NOT_PINNED; /trekbrief proposes /bin/bash.
- A7: the plan template's and /trekplan's checkpoints stage the step's files.

Tests fail on 5f9faee first (tests/lib/trial2-fixes.test.mjs, 11 of 14).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/verification/criteria-runner.mjs

@@ -164,6 +164,12 @@ function parseSection(markdown, heading, prefix) {
   const criteria = [];
   const push = (text, command, reason) =>
     criteria.push({ label: `${prefix}${criteria.length + 1}`, text, command, reason });
+  // A bullet indented deeper than the section's first bullet is a sub-point of
+  // the criterion above it, never a criterion of its own: one criterion with
+  // ten sub-points became SC4..SC13, each `not-a-command` (voyage-lekerepo
+  // trial 2, 2026-10-08). The parent counts them in `subpoints`.
+  let baseIndent = null;
+  let lastBullet = null;
   for (const line of lines) {
     if (line.marker) continue;
     if (line.fenced) {
@@ -175,10 +181,17 @@ function parseSection(markdown, heading, prefix) {
     }
     const bullet = line.text.match(BULLET);
     if (!bullet) continue;
+    const indent = line.text.match(/^\s*/)[0].replace(/\t/g, '    ').length;
+    if (baseIndent === null) baseIndent = indent;
+    if (indent > baseIndent && lastBullet) {
+      lastBullet.subpoints = (lastBullet.subpoints ?? 0) + 1;
+      continue;
+    }
     const text = bullet[1].trim();
     if (text === '') continue;
     const { command, reason } = firstCommand(text);
     push(text, command, reason);
+    lastBullet = criteria[criteria.length - 1];
   }
   return criteria;
 }