fix(records): keep section scan faults at full severity

[randomparity]

Summary

• route E-SECTION-SCAN through the full-severity record-checker channel
• add a grandfathered-record regression that proves scan faults are not relabelled
• keep shipped checker/test mirrors identical and bump the plugin patch version

Testing

• ./.github/scripts/check-records-test.sh (214 passed)
• just records
• just verify
• managed pre-push just ci equivalent in an isolated worktree

Closes #90

[randomparity]

verdict: approve
exit: none
findings: 0
iterations: 1
security: not triggered
delivered-head-sha: 1959710

Forge whole-branch review

forge review: not required (issue 90 plan tasks were tightly coupled, so cast mode implemented them directly with focused tests and full guardrails)