chore(trail): tune drift/security/pr-review prompts to the CLI repo

Generated with entire trail tune --run (dogfooding the new command), which rewrote the three remaining generic runner templates to fit this Go CLI:

• drift: scores against this repo's real conventions (noun-group command layout, hideAsAlias, the checkpoint Store ephemeral/persistent split, agent interface contract) instead of generic architecture drift.
• security: adversarial axes tailored to the CLI — supply chain (go.mod/sum), token/transcript egress to the remote core, redaction/condensation changes, command/path injection, CI/mise tampering, hook-installer backdoors, auth.
• pr-review: high-risk-surface hints for this codebase (destructive git ops, hook handlers, checkpoint/session mutations, condensation, auth/core resolution, agent hook contracts).

One hand-correction after review: the model had cited a nonexistent resolveref.go and a fabricated "most-flagged in past reviews" claim in pr-review; removed both, keeping only the real auth/core-resolution files.