Run guidance Security review once on Spec PRs

[JacobStephens2]

Summary

Enable one guidance Security review on the whole Spec branch after Spec review. Ticket Runs get none. Introduced findings, refusals and incomplete reviews hold the Spec PR's Self-merge while leaving it ready for review.

Tickets land on Spec branch (no Security review)
  → Spec review (commits; leaves push to Delivery)
  → one guidance Security review against Base branch
  → Delivery push → readiness and CI/conflict Repair
  → Self-merge only when the Security review permits it

Closes #551

Evidence

• Before: cargo test --test spec_run security_review_runs_once_after_spec_review_over_the_whole_spec_branch -- --exact failed: sessions were [21, 22, 20], missing the expected second Spec session.
  After: the same test passes; both Tickets, the Spec review commit and the Security fix reach the Base branch after a clean review.
• Before: cargo test --test spec_run spec_review_leaves_the_push_to_delivery_after_the_optional_security_review -- --exact failed because the Spec review prompt instructed the agent to push early.
  After: the same test passes with Delivery responsible for pushing after Security review.
• Config/command overrides, Ticket exclusion, ready PRs with introduced findings/refusals/incomplete reviews, and CI repair under a Security hold are exercised through the CLI.
• Validation passed: cargo test --test spec_run (69 passed), full cargo test (one existing ignored test), cargo check --all-targets, cargo fmt --check, cargo clippy --all-targets -- -D warnings, and UPDATE_PROMPTS=1 cargo test prompts_page.

Test seams

• The thirdshift <Spec Issue URL> CLI, observing Harness sessions, published branch contents, PR readiness and body, Self-merge outcomes, and failure causes through GitHub and Harness stand-ins.

Unaddressed findings

Standards

None. Standards review found 0 findings.

Spec

None. Spec review found 0 findings.

Review coverage

Reviewed against issue-427, pinned at 422d954bfad171bca25c2d40e2fde846660becf8. Both axes read all nine changed files; unread changed files: none. Final reports and supporting files-read lists are saved locally in .thirdshift-review-sTHbPs/standards.md and .thirdshift-review-sTHbPs/spec.md.

Merge Danger

Door: two-way

Reverting restores the previous Spec Delivery behavior. No migration or persisted state changes.

Blast Radius: Spec

Spec runs with Security review enabled gain the review and its Self-merge hold. The Spec review session leaves pushing to Delivery.

Built with codex · gpt-6.1-sol · xhigh