test: pr-dependencies' unplaceable-file example uses SECURITY.md now that ETHOS.md is mapped

6183ca8ae registered ETHOS.md on its reader cases in touchfiles-data.ts, so a
PR touching only ETHOS.md plans in pr mode and no longer restores the full gate.
The fail-closed test and the real-unknown label check now use SECURITY.md, which
is tracked and unmapped; the assertions are unchanged. CHANGELOG names the
third test file. (CI free shard 7 at 7c21720ac; remote pregate shard 6.)

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

test/pr-dependencies.test.ts

@@ -179,7 +179,7 @@ describe('safe classification (A1-2)', () => {
       }
       expect(unknownFileLabel(file).label).toBe('full-gate input');
     }
-    expect(unknownFileLabel('ETHOS.md').label).toBe('real unknown dependency');
+    expect(unknownFileLabel('SECURITY.md').label).toBe('real unknown dependency');
   });
 });
 
@@ -264,7 +264,7 @@ describe('the fail-closed full-gate list', () => {
   });
 
   test('a file the derivation cannot place restores the full gate with its fix', () => {
-    for (const file of ['ETHOS.md', 'conductor.json']) {
+    for (const file of ['SECURITY.md', 'conductor.json']) {
       const result = computePaidCaseSelection({ profile: 'pr', env: {}, changedFiles: [file], packageVersionOnly: true });
       expect(result.coverage?.mode, file).toBe('full-fallback');
       const label = result.coverage!.unknownFileLabels[0]!;