fix(ci): resync the bot prompts with the repo and close the gaps an audit found

The three prompts still enforced the comment ban CLAUDE.md replaced with
the 2-line cap on Aug 1 (1ff90c5b), so the review bot would flag every
legitimate short comment; frontend/CLAUDE.md and CONTRIBUTING.md carried
the same stale rule. The PR reviewer's recipe for reading a post-change
file (headRefOid + pr diff) was unfulfillable with its allowlist - it now
fetches refs/pull/N/head and reads blobs via git show, object-only, no
checkout. Conventions the reviewer checks now include the unchecked docs
openapi.json copy step, the docs/lib/xray third link implementation, the
both-ways route contract, and the i18n dead-key half of the rule.

Also: drop the SUBPROCESS_ENV_SCRUB=0 override on the two untrusted-input
jobs (the mention job proves gh works scrubbed); teach the triage prompt
the issue forms (pre-applied labels, required fields, no re-asking); add
a security-report exception plus SECURITY.md so vulnerabilities are not
confirmed publicly; add a clarification follow-up job so a reporter's
reply to "clarification needed" is actually processed; review PRs again
on ready_for_review and skip drafts; stamp the reviewed head SHA so
force-pushes visibly date a review; scope gh issue/pr edit to label and
title flags; per-job concurrency; comment guards now match the actual
bot login after the run started; artifact names survive re-runs; the
mention prompt's repo map and env-var facts corrected (XUI_PORT,
XUI_TUNNEL_HEALTH_*, distro env files, memory.high, encrypt-tokens).
The bug and feature forms also referenced a "needs triage" label that
does not exist in the repo and was silently never applied - dropped.

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -1,7 +1,7 @@
 name: Bug report
 description: Report something that is broken or behaving unexpectedly
 title: "[Bug]: "
-labels: ["bug", "needs triage"]
+labels: ["bug"]
 
 body:
   - type: markdown
@@ -64,7 +64,10 @@ body:
     id: screenshots
     attributes:
       label: Screenshots
-      description: Drag images directly into this field. Redact any sensitive data.
+      description: |
+        Drag images directly into this field. Redact any sensitive data.
+        Images cannot be searched or machine-read — always paste the exact
+        error text or log lines as text in the fields above as well.
     validations:
       required: false