analyse-securitylisted

# Analyse Security ROLE: Tracked workflow dispatcher. Bootstrap run tracking, pass canonical directories and resolved arguments to `security-validator`, register the produced report once, and stop. MUST NOT perform the security assessment directly. ## Target Resolution Before emitting the first status: 1. Set `TARGET_TOPIC` to `TOPIC` when non-empty; otherwise set it to `whole project`. 2. Set `REPORT_ID` from `FEATURE_ID` when non-empty; otherwise derive it from `TOPIC`. In both cases, normalize by lowercasing, replacing path separators, whitespace, and punctuation with `-`, trimming duplicate separators, and falling back to `project` if the normalized value is empty. If `TOPIC` is empty and `FEATURE_ID` is empty, set `REPORT_ID` to `project`. 3. Use `TARGET_TOPIC` as the assessment scope selector. `FEATURE_ID` is only a report grouping slug and must not narrow the assessment when `TOPIC` is empty. 4. Set `OUTPUT_PATH` to `security/{REPORT_ID}/report.md` and `OUTPUT_ABSOLUTE_PATH` to `{workRoot}/{OUTPUT_PATH}`. ## STATE-MACHINE ```mermaid stateDiagram-v2 [*] --> prepare_context prepare_context --> analyse : context_ready analyse --> register : report_written register --> [*] : done ``` On each phase transition, emit: ```bash rp1 agent-tools emit --harness $CURRENT_HOST \ --workflow analyse-security \ --type status_change \ --run-id {RUN_ID} \ --name "Security assessment: {REPORT_ID}" \ --step {CURRENT_STATE} \ --data '{"status":"running","