fix: repoint scitex_audit -> scitex_security (audit is archived)

[ywatanabe1989]

Why

scitex-audit is now a public archive on GitHub per the operator's ruling. The umbrella must not declare or re-export an archived package.

ADR-0002 made scitex-security canonical and reversed ADR-0001's direction — but the reversal was never finished. The umbrella still pinned scitex-audit==0.2.0 in main deps, in [audit], in [security], and lazily resolved scitex.security → scitex_audit.github.

The migration is a no-op — nothing to port

Established by comparing symbols, not filenames, before touching anything: audit has 51 public symbols, security 52. All six audit-only symbols are mirror images, not gaps — and the docstrings settle the direction:

• audit's _migrate_legacy_security_dir → "Per ADR-0001" (security→audit)
• security's _migrate_legacy_audit_dir → "One-shot REVERSE migration… Per ADR-0002" (audit→security)

So audit's uniques are the superseded direction. Porting them in would reimport the very thing being removed. The other two are _cmd-suffix renames; four modules are byte-identical after name normalization.

Verified before changing a published dependency graph

• scitex-security==0.2.0 is on PyPI (a repoint to an unpublished package would break installs).
• scitex_security.github carries all five public symbols: check_github_alerts, save_alerts_to_file, format_alerts_report, check_gh_auth, GitHubSecurityError.

Scope: nine lines, all code

file	change
pyproject.toml	4 dependency declarations → scitex-security
src/scitex/__init__.py	scitex.security external → scitex_security.github
src/scitex/re_export.py	"audit" / "security" mappings → scitex_security
src/scitex/cli/audit.py	_format import → scitex_security
_skills/scitex/03_python-api.md	the mapping table

Historical comments are deliberately untouched. They describe ADR-0001 accurately; rewriting them would make the file misdescribe its own history. (I initially applied a blanket sed, which silently rewrote those comments to claim ADR-0001 routed to scitex_security — false. Reverted and redid it line by line.)

No shim — the operator's ruling is explicit that a re-export shim is itself garbage. And no yank: scitex-audit 0.2.0 stays on PyPI as historical; archiving is not yanking, and yanking breaks installed callers.

Not in scope

scitex_security/_paths.py references scitex-audit by design — those are the reverse-migration's identity strings (.migrated_from_scitex_audit_user, audit/github-alerts). Renaming them would re-fire the one-shot migration on users who already migrated. Left alone.