docs: template-based repo creation + Troubleshooting section

[Neil-Smithline]

What

Updates docs/security-review-setup.md:

1. Creating a new repo now recommends creating from the org template:

   gh repo create radius-workshop/<name> --template radius-workshop/repo-template --clone --private
   

   This seeds commit zero with README.md, CLAUDE.md, AGENTS.md, and
   GEMINI.md, so whichever agent a developer uses (Claude Code, Codex, Gemini)
   reads the same security-gate rules from the first commit. Those files are a
   reviewed baseline — they entered repo-template through a scanned PR. The
   bare --add-readme path is dropped and the commit-zero rationale updated to
   match.

2. New Troubleshooting section documenting the failure modes we've hit:

   • org-wide scan outage → check the ruleset rules array (and history) first
   • a single PR unscanned/stale → re-trigger it
   • a check that shows but doesn't block → confirm the workflows rule
   • a new repo left empty after --template create → the require-workflows
     rule's do_not_enforce_on_create must be true
   • .github's own PRs are exempt from the scan (source-repo exemption)
   • all scan-behavior changes belong in this repo, never per-repo

Note

radius-workshop/.github PRs are exempt from the security scan (documented in
the new section), so this PR merges via the admin bypass rather than a green
Claude check.