fix(review): the review's fix round - engines' key in rule_key, --brief only with --record, the gate's threat model from the review's work tree

The one narrow fix round after /code-review high on E (three findings of
new classes; the between-rounds findings are known issues, decision 226):

- threat-model.mjs isOwnSecurityFinding: the engines' key in rule_key is
  never Voyage's own, also when rule_keys names a key of its own (keysOf
  reads rule_keys alone when it is a list, so an entry with rule_key
  SECURITY_REVIEW_VULNERABILITY and rule_keys [SECURITY_RISK] could be
  backed, against decision 218).
- plan-gate.mjs: --brief without --record is a usage error (exit 2); the
  bare gate and --accept-open read the verdict's brief_path, and a --brief
  there was silently ignored.
- verdict-gate.mjs: the known_outside check reads the threat model from the
  answers' repo (--repo, else the review file's own work tree); with no
  work tree nothing is backed. A review outside any work tree, gated from
  another repo, was backed by that repo's brief (ALLOW).

Each with a test seen failing on an assertion first.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/validators/plan-gate-threat-model.test.mjs

@@ -329,6 +329,25 @@ test('CLI: --brief without a value is a usage error; a threat model that is not
   }
 });
 
+test('CLI: --brief is read only with --record; on the bare gate or --accept-open it is a usage error, never ignored (review fix)', () => {
+  const dir = tempRepo('plan-gate-tm-');
+  try {
+    const p = join(dir, 'plan.md');
+    writeFileSync(p, buildPlan());
+    writeFileSync(join(dir, 'brief.md'), BRIEF);
+    for (const args of [[p, '--brief', 'brief.md'], [p, '--json', '--brief', 'brief.md'], ['--accept-open', p, '--brief', 'brief.md']]) {
+      const r = run(dir, args);
+      assert.equal(r.code, 2, `${args.join(' ')}: exit 2, got ${r.code}: ${r.out}${r.err}`);
+      assert.match(r.out + r.err, /--brief is read only with --record/, `${args.join(' ')}: says why`);
+    }
+    // Control: the bare gate without --brief still decides (no verdict yet: STOP, exit 1).
+    const bare = run(dir, [p]);
+    assert.equal(bare.code, 1, bare.out + bare.err);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
 // ---- Part 2 fix round ---------------------------------------------------------------
 
 test('fix 1: a string entry in a reviewer\'s findings still counts as a blocker through dedup and --record', () => {