fix: attribute shared-harness security calls as auxiliary

[time-attack]

Fixes #889. Reported by @ianTPE from a running QM deployment.

The shared one-shot runner fabricated turn 1 and forwarded its LLM recorder unchanged. Security screens in the Claude, Codex, and OpenCode harnesses consequently appeared as steps of the real conversation's first turn, and were absent from the security-screen replay corpus.

This fixes the shared path once:

• One-shot request records get turnSeq: null.
• Only screenSecurity stamps the existing SECURITY_SCREEN_STEP, matching Pi and the mock harness.
• Records, usage fields, errors, and request cancellation are preserved. No calls are deduplicated or discarded; no schema change or historical-data rewrite.

Validation

• Regression tests failed before the fix and pass afterward.
• Affected harness sweep: 123 passed, 1 existing skip, 0 failed.
• Harness-shared, auto-flagger, and admin-observability suites: 38 passed, 0 failed.
• Core typecheck, full ESLint, and full Oxlint passed.
• Independent fresh-context review accepted the patch; the request-signal naming nit was addressed.

The new tests cover both generic one-shot attribution and screening-specific coordinates. The production change is confined to the shared harness helper.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}