fix(portfolio): thread security cohort contract

[saagpatel]

What

Thread the expected GitHub security cohort count from both CLI surfaces through portfolio-truth generation and canonical receipt loading.

Why

The collector and receipt writer support a nondefault cohort size, but portfolio truth silently validated receipts against the hardcoded default. A producer using an explicit count could therefore create a valid receipt that the consumer rejected.

Review Of What Was Built

• Added --portfolio-truth-security-cohort-count to report and legacy CLI parsing.
• Passed the configured count through the app into receipt validation.
• Added regression coverage for nondefault receipt loading and CLI/app parameter threading.

Cleanup Review

Intentionally left the divergent local catalog patch and nine historical local commits out of this PR. Their policy edits are either superseded by current main or conflict with the active Tier 0 contract.

Verification Summary

• uv run --extra dev --extra serve --extra semantic --extra config pytest -q: 2939 passed, 2 skipped
• uv run --extra dev ruff check .: passed
• Scoped CI mypy command: passed for 15 source files
• git diff --check: clean

Shipped Summary

The security receipt collection contract can now use a nondefault cohort count end to end without being rejected by portfolio truth.

Next Phase

Losslessly reconcile the dirty/diverged primary checkout: preserve the old commit line under named backup refs, preserve the uncommitted patch in a named stash, and restore main as a clean tracking branch before canonical truth regeneration.

Remaining Roadmap

Regenerate canonical portfolio truth from merged main, run the seam linter, and verify PortfolioCommandCenter consumes the corrected authority.