docs(review): /trekreview chooses its security engine (E 3.2)

Phase 4.7 of /trekreview runs security-engine.mjs choose first. Claude
Security runs through its own skill (scan changes --base {before_sha}
--effort high); its cost question goes to the operator, and "No", a
question nobody can answer or a missing Workflow tool records it as not
run, never a fallback to /security-review. /security-review runs only
when choose picked it. Its report is converted by security-engine.mjs
convert, never transcribed; below_threshold is declined as
engine:below-threshold. With no engine the expected reviewer
security-engine never reports, so the verdict gate exits 2 and the
summary says "security: not measured" and why, never 0. --quick keeps no
security engine. The Engine summary line, the template's ran line, the
hard rules (the engine's report folder, scan changes only) and the
allowed-tools (Workflow) follow.

Engine prose follows in commands/trekexecute.md, docs/command-modes.md,
docs/architecture.md, CLAUDE.md, README.md, SECURITY.md and Handover 6:
Claude Security recommended, proprietary so called by name and never a
manifest dependency; without it /security-review; with neither "not
measured".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -343,7 +343,7 @@ A run stops only on a **closed list**: something that cannot be undone · someth
 
 ### The review at the end — a gate (P11)
 
-After the last step, and with nobody typing anything, the executor runs Cherny's order: **run the thing** (the plan's `## Verification`, its end-to-end criterion included) → **`/simplify`** (Claude Code's cleanup skill; edits outside the run's files are restored, and a cleanup that breaks the verification is reverted) → **`/trekreview`** (Claude Code's `/code-review` and `/security-review`, then Voyage's check against the brief) → **`verdict-gate.mjs`**.
+After the last step, and with nobody typing anything, the executor runs Cherny's order: **run the thing** (the plan's `## Verification`, its end-to-end criterion included) → **`/simplify`** (Claude Code's cleanup skill; edits outside the run's files are restored, and a cleanup that breaks the verification is reverted) → **`/trekreview`** (Claude Code's `/code-review` and a security engine — Claude Security, else `/security-review` — then Voyage's check against the brief) → **`verdict-gate.mjs`**.
 
 | Verdict gate | Merge into main |
 |---|---|
@@ -470,7 +470,7 @@ and a contracted **Handover 6 (review → plan)** so findings can be fed back in
 the iteration loop without ad-hoc conventions.
 
 **The review is a gate.** In this order: Claude Code's own `/code-review` and
-`/security-review` find correctness and security defects (started through the
+a security engine find correctness and security defects (started through the
 Skill tool, never with `--fix`); Voyage's control against the brief runs after
 them and is the part that stops. The verdict is written in `review.md`
 (`verdict: ALLOW | WARN | BLOCK`, required) and one command decides on it:
@@ -485,9 +485,23 @@ review that was not performed in full stops a merge.
 
 No finding is struck for length: only MINOR/SUGGESTION text is trimmed, and
 counted; what the coordinator set aside is listed under `## Declined to
-Judge`. An engine that could not run (older Claude Code, no `origin` remote)
-keeps the review from coming back `ALLOW` — and from passing the gate — and
-the summary says why.
+Judge`. An engine that could not run (older Claude Code, no `origin` remote,
+Claude Security's cost question answered "No") keeps the review from coming
+back `ALLOW` — and from passing the gate — and the summary says why.
+
+**The security engine.** Claude Security is the recommended one. When its
+plugin is installed (`/plugin install claude-security@claude-plugins-official`;
+it needs Python 3.9 or newer on `PATH` and Claude Code's Workflow tool),
+`/trekreview` runs its `scan changes` over the review's range, after Claude
+Security's own question about the scan's cost, which is put to you. Claude
+Security has a proprietary licence, so Voyage calls it by name and it is never
+a dependency in Voyage's manifest. Without it, `/trekreview` uses Claude Code's
+`/security-review` (it needs an `origin` remote and reads the branch against
+origin's default branch). With neither engine able to look (no Claude Security
+and no `origin` remote, or a branch that is already on origin's default
+branch), security is "not measured", never 0, and the verdict gate exits 2. A
+Claude Security finding blocks only at confidence `high`; the rest are listed
+under `## Declined to Judge` and keep the review from `ALLOW`.
 
 **One stance for every reviewer.** Both reviewers and the coordinator preload
 the `voyage:reviewing-adversarially` skill, and `/trekreview` names it when it
@@ -502,9 +516,9 @@ Declined to Judge list, and the coordinator carries those lines into
 
 | Mode | Command | Description |
 |------|---------|-------------|
-| **Default** | `/trekreview --project <dir>` | Claude Code `/code-review` + `/security-review`, then brief-conformance + code-correctness reviewers in parallel, coordinator dedup + verdict, write `{dir}/review.md`, verdict gate |
+| **Default** | `/trekreview --project <dir>` | Claude Code `/code-review` + the security engine (Claude Security, else `/security-review`, else "not measured"), then brief-conformance + code-correctness reviewers in parallel, coordinator dedup + verdict, write `{dir}/review.md`, verdict gate |
 | **Since ref** | `/trekreview --project <dir> --since <ref>` | Override "before" SHA for the diff range. Validated via `git rev-parse --verify` |
-| **Quick** | `/trekreview --project <dir> --quick` | `/code-review` + code-correctness reviewer only; skip brief-conformance reviewer, `/security-review` and the coordinator's reasonableness filter except the brief-conflict rule — fast correctness-only pass |
+| **Quick** | `/trekreview --project <dir> --quick` | `/code-review` + code-correctness reviewer only, no security engine; skip brief-conformance reviewer and the coordinator's reasonableness filter except the brief-conflict rule — fast correctness-only pass |
 | **Validate** | `/trekreview --project <dir> --validate` | Schema-only check on existing `review.md`. No LLM calls |
 | **Dry run** | `/trekreview --project <dir> --dry-run` | Print discovered scope + triage map; skip writes |