fix(browse): remove the dead security shield + unfed /health.security (re-derived from #2557)

The sidebar's SEC shield has been dead UI since the PTY terminal rewrite:
nothing set its data-status, nothing unhid it, and the /health.security
field behind it read getStatus() off ~/.gstack/security/session-state.json
— a file whose ONLY writer (sidebar-agent.ts) was deleted with the chat
path. /health therefore reported a permanent 'inactive', or a stale
FALSE-GREEN 'protected' wherever an old state file survived on disk (a
single unit-test run was enough to plant one). A green shield sourced from
leftover state reads as "no threats detected" when the real state is "not
measured" — the same fail-open class as #2026.

Removed (dead surfaces only): the shield markup/CSS and the stale
sidepanel.js comment; the /health security field and server.ts's getStatus
import; getStatus / SecurityStatus / StatusDetail / SessionState /
read+writeSessionState (and security.ts's dead child_process import); the
session-state + getStatus unit tests — including the round-trip test that
wrote real fixture data into ~/.gstack and left /health green forever.
(The PR's security-sidepanel-dom.test.ts deletion already happened on main
via #2230; its resolveDisconnectCause guard landed via the #2085 typeof
fix. Neither re-applied.)

Kept, per ENG-OV9 — security.ts has LIVE consumers: the pure combiner
(combineVerdict + THRESHOLDS), canary utilities, and extractDomain stay;
server.ts's /pty-inject-scan L4 path (isSidecarAvailable + scanWithSidecar)
is untouched. browse/test/server-security-surface.test.ts pins BOTH
directions: the dead surface stays dead (no /health security field, no
getStatus import, no reader of the security session-state file, shield
markup gone) and the live half stays live (sidecar wiring in server.ts,
combiner/canary exports in security.ts, /health carries no token — the
v1.63 regression wall). A future re-feed from LIVE signals must update
that test deliberately rather than resurrect the state-file path.

F13 (same commit): CLAUDE.md's Sidebar security stack section, ARCHITECTURE.md's
prompt-injection Visibility + critical-constraint paragraphs, and
BROWSER.md's security section now describe the removed surfaces as history,
not live features.

Net -166 lines. Tests: server-security-surface + security +
security-adversarial(+fixes) + security-integration + server-auth 114 pass;
sidepanel-* + extension-token + extension-sender-auth 58 pass / 2 skip.

Re-derived from PR #2557 by @frederik-kaster-noygear.

Co-authored-by: Frederik Kaster <frederik.kaster@noygear.ai>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

extension/sidepanel.css

@@ -47,39 +47,6 @@
   --radius-full: 9999px;
 }
 
-/* ─── Security Shield ───────────────────────────────────────────── */
-/* 3 states — green=protected, amber=degraded, red=inactive.
-   Custom SVG outline + "SEC" label in JetBrains Mono to match the
-   industrial/CLI aesthetic (design review Pass 7 decision). */
-
-.security-shield {
-  position: absolute;
-  top: 6px;
-  right: 8px;
-  z-index: 10;
-  display: inline-flex;
-  align-items: center;
-  gap: 4px;
-  padding: 2px 6px;
-  border-radius: var(--radius-sm, 4px);
-  font-family: var(--font-mono, 'JetBrains Mono', monospace);
-  font-size: 10px;
-  font-weight: 500;
-  letter-spacing: 0.04em;
-  background: rgba(255, 255, 255, 0.02);
-  transition: color 200ms ease-out, background 200ms ease-out;
-  cursor: default;
-}
-.security-shield[data-status="protected"] {
-  color: var(--success, #22C55E);
-}
-.security-shield[data-status="degraded"] {
-  color: var(--amber-400, #FBBF24);
-}
-.security-shield[data-status="inactive"] {
-  color: var(--error, #EF4444);
-}
-
 /* ─── Connection Banner ─────────────────────────────────────────── */
 
 .conn-banner {
@@ -129,10 +96,11 @@
 
 .security-banner {
   position: relative;
-  /* Sit above the absolutely-positioned security-shield (z-index: 10) so
-     the banner's close button and controls receive clicks. Without this
-     the shield at top-right overlaps the banner's close X region and
-     intercepts pointer events. */
+  /* Kept above other absolutely-positioned chrome so the banner's close
+     button and controls receive clicks. This originally guarded against
+     the top-right security shield (z-index: 10) overlapping the close X
+     and intercepting pointer events; that shield has since been removed
+     (#2557 — dead UI since the PTY terminal rewrite). */
   z-index: 20;
   padding: 20px 16px;
   text-align: center;