fix(catalog): unify negation guard and harden round-2 evaluators

A shared NoUnnegatedMention primitive replaces four per-category
implementations, with a bidirectional clause-scoped window and an
adjectival cue set. The docker layer fixture drops WORKDIR, which
creates a real layer and made the pinned answer wrong. The replica
failover test now forces a JSON verdict so a negated answer cannot
score. Remaining exact-answer tests migrate to ExactToken. Ordering
prompts shuffle their candidate lists so echoing scores zero.

internal/tests/security_test.go

@@ -34,8 +34,8 @@ func TestRegisterSecurityTests_Wiring(t *testing.T) {
 		if tc.Description == "" {
 			t.Errorf("test %q: Description is empty", tc.ID)
 		}
-		if tc.MaxTokens < 0 {
-			t.Errorf("test %q: MaxTokens = %d, want >= 0", tc.ID, tc.MaxTokens)
+		if tc.MaxTokens != 0 {
+			t.Errorf("test %q: MaxTokens = %d, want 0 (omitted, per round-2 rule 7)", tc.ID, tc.MaxTokens)
 		}
 		counts[tc.Subcategory]++
 	}