fix: close scenario quality security and validation gaps

[shenjiecode]

Summary

Closes the four gaps found when reviewing develop@efef55e against the scenario-design-quality change:

• Enforce sensitive-path and file-type checks on BOTH diff endpoints, retain old path/mode for modifications, and use literal Git pathspecs.
• Reject initialization plans that omit newly added/content-modified approved scenarios; keep draft and unchanged-existing scenarios outside forced selection and exempt byte-identical renames.
• Preserve candidate scope and coverage-gap summaries in the special two-artifact report, with existing credential redaction, link/path/code/diff filtering, bounded output, and explicit missing/truncated notices. The summary stays inside the existing plan artifact.
• Paginate fixed base/target file contents at 32 KiB UTF-8 boundaries; bind cursors to commit pair, version and path.

Adds regression tests and updates the per-AC local acceptance mapping, role instructions, Spec and Plan. Corrects the earlier overly broad engineering-completion claim; Phase 5 real-model planning/Reviewer comparisons remain not_run/blocked.

Validation

Using existing Docker quality image luowang:0.3.1-quality-candidate (11c930d63cb2) with current source/tests/resources/docs/package/workflow mounted read-only. Its lockfile SHA-256 matches the current repository (46406eef352d638790d8537d4c3cd72fe58acf108be6800326266903b2c71281).

• format:check, typecheck, lint: passed
• 25 test files, 153/153 tests: passed
• build and both headless E2E smokes: passed
• test:acceptance:local: local=passed, live=blocked, release=blocked
• git diff --check: passed

Fresh quality-image build was blocked by npm mirror ECONNRESET; reused-image validation is not claimed as a new-image build proof. No real model calls, external website writes, deployment, release or history rewriting.

Local command evidence: .cynos/acceptance/sdq-review/fix-quality.log, fix-final.log, fix-acceptance.log (not committed).