Publish spec-size security fixes through staged text #638

Spec-review finding A1 on the issue-629 change (PR from branch issue-629 against issue-626).

What the finding is: issue #629 removes the session-created path only for single public fixes. Spec-size public fixes still publish by the session running gh issue create itself ('A spec still publishes its issues itself, as before'), validated only after creation, so the literal 'all public writes go through the validated staged path' does not yet hold for multi-issue Specs.

Evidence: src/security/fixing.rs keeps the session-created URL path for everything that is not a single public fix ('Anything else keeps the session-created issue path until staged specs land'); the existing test a_bigger_public_fix_publishes_tickets_and_ends_as_the_spec_run exercises the session-created spec path.

Which PR raised it: the issue-629 pull request (branch issue-629 against issue-626), Spec review finding A1.

Why this call is not the implementer's to make: the staged-spec format (top issue plus tickets in one staged message), thirdshift-created sub-issue and blocking links, and the prompt contract need Spec design before implementation.