docs(security): record the fail-open content-screening posture as an ADR (extend ADR-009 or add ADR-023)

[ClintEastman02]

Non-blocking follow-up from the PR #788 review (and @scottschreckengaust's #756 triage).

Problem

PR #788 added the same fail-open justification as ~4 independent inline nosemgrep comments across the webhook screening paths (jira-webhook-processor.ts screenCommentsOrDrop; linear-webhook-processor.ts screenProjectDocsOrDrop / screenCommentsOrDrop). Fail-open on a content-screening outage is a deliberate security posture choice — defensible for advisory third-party enrichment (comments/docs are dropped, logged, and the reporter's own task proceeds) — but right now that decision is re-litigated per call site instead of being recorded once.

Per the triage: "it should be an ADR line rather than four independent inline comments."

Proposed fix

Record the posture once as a short ADR — either a section in ADR-009 (security-posture-dev-agents) or a new ADR-023 — stating:

• Advisory third-party enrichment (Jira/Linear comments + project docs) screening fails open: on a guardrail/screening outage the content is dropped (never admitted unscreened) and the task proceeds on the reporter-authored title/description.
• Reporter-authored content and attachments screening fails closed — the boundary the code already draws (e.g. the attachment paperclip path in linear-webhook-processor.ts).
• The inline nosemgrep comments then reference the ADR instead of each restating the rationale.

Regenerate the Starlight mirror (mise //docs:sync) after adding/editing the ADR.

Context

• PR chore(security): ratchet silent-success-masking gate + clear 5 Category 3 findings (#756) #788 (Category 3 suppressions), chore(security): clean up 21 pre-existing silent-success-masking findings on main #756 (umbrella), fix(security): clear the two security:sast findings blocking pre-push (#729) #730 (anti-blanket-suppression precedent)
• The fail-open / fail-closed boundary was confirmed correct in the PR chore(security): ratchet silent-success-masking gate + clear 5 Category 3 findings (#756) #788 review — third-party content is dropped, never admitted unscreened.