Optimize the security skill family

[potiuk]

Part of #1342 — apply the setup-family optimization recipe to the security family.

15 skills, 145,121 body tokens in total; 11 over the 200-token always-on budget, 11 over the 5,000-token body budget.

skill	body tokens (budget 5,000)	always-on tokens, est. (budget 200)	lines (cap 500)
security-issue-import	28,931 ⚠	~280 ⚠	2181 ⚠
security-issue-triage	13,159 ⚠	~278 ⚠	1138 ⚠
security-issue-invalidate	12,379 ⚠	~251 ⚠	1034 ⚠
security-issue-fix	11,910 ⚠	~214 ⚠	1084 ⚠
security-cve-allocate	11,198 ⚠	~203 ⚠	910 ⚠
security-issue-import-from-pr	10,050 ⚠	~239 ⚠	909 ⚠
security-issue-import-via-forwarder	7,955 ⚠	~291 ⚠	677 ⚠
security-model-verify	5,544 ⚠	~293 ⚠	457
security-model-update	4,845	~323 ⚠	355
security-issue-import-from-scan	4,506	~237 ⚠	334
security-model-prepare	3,658	~251 ⚠	308
security-issue-sync	9,944 ⚠	~185	776 ⚠
security-issue-import-from-md	9,172 ⚠	~125	862 ⚠
security-issue-deduplicate	8,051 ⚠	~189	733 ⚠
security-tracker-stats-dashboard	3,819	~107	339

Body tokens are from docs/mode-economics.md; always-on figures are a chars ÷ 4 estimate of description + when_to_use. ⚠ marks a budget exceeded. Line counts include the generated pre-flight block.

Order of work (per the umbrella):

1. Trim the frontmatter of every skill marked ⚠ in the always-on column.
2. Split any over-cap body, moving sub-action-specific rules into sibling files byte-for-byte.
3. Wording pass on the rest, with headings, golden-rule headlines, code blocks and the pre-flight block kept byte-identical.
4. Run each touched skill's eval suite before and after, outside the sandbox.

Record any inconsistencies found but not fixed (eval-coupled wording, stale headings) in the PR description.