Reword security audit guidance for defensive remediation

[beastawakens]

This updates the security section of the audit playbook to use more explicitly defensive, remediation-focused language.

The intent is to preserve the same review coverage while making the instructions friendlier to stricter safety-routed models that may treat vulnerability-investigation phrasing as higher risk. The revised wording asks agents to:

• report only code-evidenced findings
• avoid runnable demonstration strings or step-by-step misuse details
• keep findings focused on production impact and remediation
• continue protecting secrets by referencing only credential type and location
• distinguish platform conventions from implementation-specific risk

This should make the skill more reliable with stricter models while keeping security improvement work practical and actionable.