chore: make 'make security' fail-fast when govulncheck is absent

[millerjp]

Summary

make security silently skips with an install hint if govulncheck isn't on PATH — exits 0. make check on a clean dev machine therefore passes without actually running the security gate. CI installs the tool explicitly so CI is fine, but a developer running make check before pushing gets false confidence.

Scope

Drop the soft-skip branch in the security Makefile target. Fail with the install hint if the tool is missing.

Acceptance criteria

1. make security without govulncheck exits non-zero with a clear install instruction.
2. CI (which installs the tool) still passes.
3. make check behaviour on CI unchanged.

Source: go-quality agent.