docs(checklist-test): a QA security finding gets no card and goes privately to the PM session, runners only test, and runner dispatches state effort by card shape - #27642