Ask about Security fixing during Setup

[JacobStephens2]

Summary

Setup now asks whether Security runs may fix reproduced findings, off by default. Rerunning Setup uses the saved answer.

Setup
  ask security.fix (saved answer, otherwise false)
  write User config
    save security.fix answer
    complete missing security.harness = "" with its comment
    preserve a configured Security Harness

Closes #548

Evidence

• Before: cargo test --test setup setup_asks_once_about_security_fixing_with_off_as_the_default_and_writes_yes -- --exact failed: the terminal never showed the fixing question.
  After: the same regression passes, including writing fix = true and a blank, commented Harness setting.
• Terminal regressions cover the off default, one fixing question per interaction, keeping enabled fixing, turning it off, retaining the disabled answer, and preserving a custom Security Harness and comments. Cancellation at the fixing question writes nothing.
• Validation: cargo check --all-targets, cargo fmt --check, cargo clippy --all-targets -- -D warnings; full cargo test (1592 passed, 1 ignored). All passed.

Test seams

• Existing end-to-end Scenario seam: the real thirdshift setup command on a terminal or without one, observing its questions and written User config.

Review

thirdshift-code-review against issue-427, pinned at 1bff3a03089b81435fc456eb2a2f8089e394bde6: Standards 0 findings; Spec 0 findings. Each axis read all eight changed files. Changed files left unread: none.

Unaddressed findings

Standards

None.

Spec

None.

Merge Danger

Door: two-way

Blast Radius: Setup

Changes Setup's questions and config writing; reverting restores the previous interaction.

Built with codex · gpt-6.1-sol · xhigh