fix: resolve moderate issues across config

- architect: restore effort: max to match orchestrate team roster
- orchestrate: remove researcher background annotation (blocks planning),
  remove overly broad auditor trigger clause, risk-tag table is authoritative
- qa-checklist: add auditor hard rules (security_findings, build/test status)
- settings.json: simplify .env deny to single **/.env* glob per tool
- rules/01-session: clarify persistent context includes .claude/memory/
- memory: rename todo_inter_agent_schema.md → inter_agent_schema.md

skills/orchestrate/SKILL.md

@@ -13,7 +13,7 @@ You (orchestrator)
   ├── worker        (sonnet default — haiku for trivial, opus for architectural)
   ├── debugger      (sonnet) — bug diagnosis and minimal fixes
   ├── documenter    (sonnet) — documentation only, never touches source
-  ├── researcher    (sonnet, background) — one per topic, parallel fact-finding
+  ├── researcher    (sonnet) — one per topic, parallel fact-finding
   ├── architect     (opus, effort: max) — triage, research coordination, architecture, wave decomposition
   ├── reviewer      (sonnet) — code quality + AC verification + claim checking
   └── auditor       (sonnet, background) — security analysis + runtime validation
@@ -104,7 +104,7 @@ For each wave in the plan:
 After each wave, spawn `reviewer` and `auditor` in a single response. They run in parallel.
 
 - **Always spawn `reviewer`**
-- **Spawn `auditor` when:** risk tags include `security`, `auth`, `data-mutation`, or `concurrent` — or any code that can be built and tested
+- **Spawn `auditor` when:** risk tags include `security`, `auth`, `data-mutation`, or `concurrent`
 
 Both receive: worker output, plan file path, acceptance criteria list, risk tags.