fix(review): the review's fix round - engines' key in rule_key, --brief only with --record, the gate's threat model from the review's work tree

The one narrow fix round after /code-review high on E (three findings of
new classes; the between-rounds findings are known issues, decision 226):

- threat-model.mjs isOwnSecurityFinding: the engines' key in rule_key is
  never Voyage's own, also when rule_keys names a key of its own (keysOf
  reads rule_keys alone when it is a list, so an entry with rule_key
  SECURITY_REVIEW_VULNERABILITY and rule_keys [SECURITY_RISK] could be
  backed, against decision 218).
- plan-gate.mjs: --brief without --record is a usage error (exit 2); the
  bare gate and --accept-open read the verdict's brief_path, and a --brief
  there was silently ignored.
- verdict-gate.mjs: the known_outside check reads the threat model from the
  answers' repo (--repo, else the review file's own work tree); with no
  work tree nothing is backed. A review outside any work tree, gated from
  another repo, was backed by that repo's brief (ALLOW).

Each with a test seen failing on an assertion first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

lib/validators/plan-gate.mjs

@@ -787,6 +787,12 @@ if (isMain(import.meta.url)) {
     out({ code: 2, status: 'error', message: unknown.length ? `unknown argument: ${unknown.join(' ')}` : 'bad arguments' });
     process.exit(2);
   }
+  if (bIdx >= 0 && !args.includes('--record')) {
+    // The bare gate and --accept-open read the verdict's stored brief_path; a --brief there would be ignored.
+    process.stderr.write(`${usage}\n`);
+    out({ code: 2, status: 'error', message: "--brief is read only with --record; the gate reads the verdict's brief_path" });
+    process.exit(2);
+  }
   let text;
   try {
     if (!existsSync(planPath)) throw new Error('file not found');