feat(security): promote Security Scan out of Labs

[graydawnc]

What

Security Scan graduates from a Labs experiment to a standard, always-on feature. After a month in Experimental with no problem reports, the two gating layers are removed:

• Build gate — VITE_FEATURE_SECURITY / securityBuildCapable() (renderer + main-process mirror). The Security code now compiles into every build; the env var is dropped from release.yml and the test:e2e script.
• Runtime opt-in — the Labs toggle persisted as agents.json securityEnabled, its securityEnabledCache mirror, the applySecurityEnabledSeed default-on seeding, and the live boot/teardown transition in the spool:ai-set-config IPC (teardownSecurity had no other caller and is deleted; the quit path keeps using shutdownScanWorker).

Every surface gate (useSecurityEnabled in Sidebar, SecurityPage, SettingsPanel, SessionDetail/RiskPill, SessionRow badge, ProjectView, SecurityPane, FindingsStrip) is removed, and the scan worker now boots unconditionally at startup. The labs.security.* strings are removed from all 7 locales.

Per-surface controls in Settings → Security (Privacy Filter, blur prefs, row risk icon, auto-rescan) are untouched — those are feature settings, not the experiment gate.

Behavior notes

• Users who had explicitly toggled Security off in Labs will have scanning turn on after upgrading — the persisted securityEnabled: false key is now ignored (left in place on disk, harmless). This is the intended semantics of removing the switch.
• A leftover securityBooted guard still protects the brief pre-boot window in the PF auto-activation path; it is no longer resettable since live teardown is gone.

Test plan

• Removed unit tests that covered the deleted resolvers (securityBuildCapable / resolveSecurityEnabled / applySecurityEnabledSeed, −14 tests); app unit suite green at 468.
• Replaced the Labs-toggle e2e (live gate on/off) with an always-on regression: sidebar Security entry present without any agents.json opt-in seed, and no labs-row-security in the Labs tab. The e2e launch helper no longer seeds the opt-in, so all ~20 security-*.spec.ts specs now exercise the always-on path.
• Coverage note: the live boot/teardown lifecycle test was removed with the mechanism it tested; worker boot stays covered by the security e2e suite and core worker unit tests.
• Full e2e suite: 168 passed, 1 skipped (pre-existing) locally on macOS.

🤖 Generated with Claude Code