fix: resolve moderate issues across config

- architect: restore effort: max to match orchestrate team roster
- orchestrate: remove researcher background annotation (blocks planning),
  remove overly broad auditor trigger clause, risk-tag table is authoritative
- qa-checklist: add auditor hard rules (security_findings, build/test status)
- settings.json: simplify .env deny to single **/.env* glob per tool
- rules/01-session: clarify persistent context includes .claude/memory/
- memory: rename todo_inter_agent_schema.md → inter_agent_schema.md

skills/qa-checklist/SKILL.md

@@ -44,7 +44,9 @@ Before returning your output, validate against every item below. If you find a v
 - Does the `type` field match your message type?
 - Does the `signal` field use a valid enum value from the message-schema skill?
 - Are all required fields for your message type present?
-- Are hard rules satisfied (e.g., `critical_count > 0` requires `signal: fail`)?
+- Are hard rules satisfied?
+  - `review_verdict`: `critical_count > 0` requires `signal: fail`
+  - `audit_verdict`: `security_findings.critical > 0` or `build_status: fail` or `test_status: fail` requires `signal: fail`
 
 ## After validation