fix(review): security lane holds only for leaks, compromise or billing, not owner-decided hold removals #11070

Problem

The claude-security-review lane holds a pull request critical-security for weakening a merge hold, even when the owner has decided that weakening and the PR quotes the decision. On #11058 at a1f05af the lane held for setting merge.diff-check.path-holds: false and wrote "The PR cites owner decision Q15, but the review could not verify it." The owner had to be brought in to lift a hold they had already decided.

The lane's criteria (plugins/review/skills/security-review/SKILL.md:170-205) count any weakened merge hold as a finding judged by the severity bar. The owner's threat model for this phase is narrower. Verbatim, from the owner's standing direction section 10:

The only actors are me, our bots, our agents and our GitHub Apps. There are no outside contributors. Holds that guard against our own actors (path holds, trust-path holds, person-approval holds, bot-author holds, pin/repin ceremony) are friction, not security boundaries, and come off now.
Section 3's "high/critical boundary" means only: a token or secret leaking, my accounts being compromised, or anything that bills me. Nothing else qualifies.

Fix

• Severity bar, part 2 (impact): HIGH/CRITICAL needs a token or secret leak, an account compromise, or a billing path. Weakening a path, trust-path, person-approval or bot-author hold, on its own, does not qualify.
• Read the owner's recorded decisions from a tracked source the lane can verify, docs/conventions/loop-lane/README.md#when-work-stops-for-the-owner, so a quoted decision does not depend on a local record. Add section 10 there if it is missing.
• Keep it reversible: when hardening returns (open issues and PRs at 0), one config edit brings the hold-weakening class back.

Done when

• A PR that only turns off a path-class hold gets no critical-security hold. An eval case shows this.
• A PR that widens a token's scope, leaks a secret or adds a billable resource still holds. An eval case shows this.
• The criteria point at the tracked owner-stop section, not a local file.

Refs: #11058