refactor(review): simplify pass over E (reuse, simplification, efficiency)

Quality only, no behaviour change (four cleanup reviewers, one implementer;
npm test 2480/0 on the working tree):

- threat-model.mjs splitBacked(): the one known_outside backing check of
  plan-gate (record and bare gate), verdict-gate and review-finalize, with
  one why-text; the engines' security keys derived from ENGINES; isSecurity.
- coordinator-contract: "not a security engine" read from ENGINES (a string
  engine only), not the code-review literal.
- review-rounds owns trailingBlock, findingsBlockSha, isMajor, isBlocker;
  review-answers imports them (review-rounds still imports nothing from it).
  prepare keeps the archive bytes it read instead of reading the previous
  archive again.
- engine-compare exports rowIn and payloadEngine; finalize uses them.
- plan-gate: one accepted_open builder; the stop-rule check hoisted; one
  top-level lookup for --record --brief.
- security-engine: notFullShas(), runCli's usage flag, readScopeList shared
  with engine-findings; findReport and reviewRoundSummary module-private;
  two dead defaults gone.
- tests: shared plan-gate harness and threat-model brief helpers; the [CNV]
  table cases call convertReport in-process, one CLI case per exit path.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/lib/security-engine.test.mjs

@@ -276,23 +276,30 @@ test('[CNV] not measured: exit 2, the reason on stderr, nothing on stdout', () =
     ['a record with an unknown confidence', { records: [record({ confidence: 'certain' })] }],
     ['a record with no title', { records: [record({ title: '' })] }],
   ];
+  // The CLI's channels, once: exit 2, nothing on stdout, the reason on stderr.
+  const cli = run(['convert', '--report-dir', reportDir(), '--base', BASE, '--head', HEAD]);
+  assert.equal(cli.status, 2, `CLI: exit 2, got ${cli.status}: ${cli.stdout}${cli.stderr}`);
+  assert.equal(cli.stdout, '', 'CLI: nothing on stdout');
+  assert.match(cli.stderr, /not measured/, `CLI: the reason on stderr says not measured: ${cli.stderr}`);
   for (const [name, opts] of cases) {
     const dir = reportDir();
     if (opts !== null) writeReport(dir, { head: HEAD, base: BASE, ...opts });
-    const r = run(['convert', '--report-dir', dir, '--base', BASE, '--head', HEAD]);
-    assert.equal(r.status, 2, `${name}: exit 2, got ${r.status}: ${r.stdout}${r.stderr}`);
-    assert.equal(r.stdout, '', `${name}: nothing on stdout`);
-    assert.match(r.stderr, /not measured/, `${name}: the reason says not measured: ${r.stderr}`);
+    const r = convertReport({ reportDir: dir, base: BASE, head: HEAD });
+    assert.equal(r.exit, 2, `${name}: exit 2, got ${r.exit}: ${JSON.stringify(r)}`);
+    assert.equal(r.payload, undefined, `${name}: no payload`);
+    assert.match(r.reason, /not measured/, `${name}: the reason says not measured: ${r.reason}`);
   }
 });
 
-/** convert's CLI on one fresh report folder per case: [name, exit, nothing on stdout, the reason says not measured]. */
+/** The convert result of one report folder: [name, exit, no payload, the reason says not measured]. */
+const convertRow = (name, r) => [name, r.exit, r.payload === undefined, /not measured/.test(r.reason ?? '')];
+
+/** convertReport on one fresh report folder per case, as convertRow gives it. */
 function convertEach(cases) {
   return cases.map(([name, opts]) => {
     const dir = reportDir();
     writeReport(dir, { head: HEAD, base: BASE, ...opts });
-    const r = run(['convert', '--report-dir', dir, '--base', BASE, '--head', HEAD]);
-    return [name, r.status, r.stdout === '', /not measured/.test(r.stderr)];
+    return convertRow(name, convertReport({ reportDir: dir, base: BASE, head: HEAD }));
   });
 }
 const notMeasuredEach = (cases) => cases.map(([name]) => [name, 2, true, true]);
@@ -381,10 +388,7 @@ test('[CNV] a symlinked stamp, JSONL or report folder is refused: not measured',
     symlinkSync(`${what}.real`, join(folder, name));
     return dir;
   };
-  const got = kinds.map((what) => {
-    const r = run(['convert', '--report-dir', linked(what), '--base', BASE, '--head', HEAD]);
-    return [what, r.status, r.stdout === '', /not measured/.test(r.stderr)];
-  });
+  const got = kinds.map((what) => convertRow(what, convertReport({ reportDir: linked(what), base: BASE, head: HEAD })));
   assert.deepEqual(got, kinds.map((what) => [what, 2, true, true]));
 });