refactor(plugin-security): move what start() registers after the authorization middleware out of security-plugin.ts

The run of statements that closes start() moves unedited to
security-plugin-start-hooks.ts as registerStartHooks: the position
catalog and grant-holder membership refusals, the permission-set name
hooks, the platform bootstrap on kernel:ready, the boot reports on
kernel:bootstrapped, the bootstrap replay and organization_admin
reconcile middlewares, and the organization_admin backfill. It closed
over start()'s ctx and ql and nothing else, so it takes them as
parameters; start() calls it from one block at the same position, the
last statement, which hands it a host literal of exactly the members it
reads. claimTargetAdminUserId, the one member the run writes, goes as a
get/set pair, so the bootstrap's write still lands on the plugin, where
the seed-ownership claim reads it.

Import names only the run reads leave security-plugin.ts.
readSeededRecordIds stays there type-only, because the seed claim's
docblock links to it, and the seed-claim import comment no longer says
this file imports the two seed-settlement readers. Move-only: no
verdict changes.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017BoLT8Gaa8t9a7AWVH8qZa

Author: claude