fix(security): point quarantine refusals at the session holding the record

[yzxcj797]

Summary

Fixes part 1 of #574: the quarantine refusal text promises an admin review, but nothing in the refusal pointed at where the review material actually lives.

The gap

Both rendering sites — slack/refusals.ts#refusalNote and delivery/run-result-delivery.ts — substituted the fixed SECURITY_QUARANTINE_REFUSAL_TEXT with no reference, even though:

• the orchestrator's refused result already carries sessionId, and
• the refused input (appended to the session transcript with securityTainted: true) and the screen's full request snapshot both live on that session, readable via GET /v1/admin/sessions/:id/llm and visible on the admin history page.

So the review the sentence promises was reachable with existing storage — only the wire-up was missing.

Fix

A quarantineRefusalText(sessionId?) helper in plugins/chassis/src/security-quarantine.ts, used by both rendering sites:

• with a session id, the refusal ends with (quarantine record: session <id>) — locates the record on the admin history page / admin API;
• without one (stored results replaying through delivery), the text is byte-for-byte unchanged;
• the internal screening reason stays hidden in both cases.

Deliberately not touching part 2 (the strict posture semantics) — that's a design discussion about whether strict should retain inbound screening, and changing posture behavior unilaterally would be the wrong way to settle it.

Tests

• slack-refusals.test.ts: quarantine note surfaces the session id; no-session fallback keeps the exact prior text; internal reason stays hidden.
• run-result-delivery.test.ts: delivery text carries the record reference for a refused result with a session.
• All 30 pre-existing refusal/delivery tests and the refusal-admin-link-integration test pass unchanged.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}