refactor(plugin-security): move SecurityPlugin's controlled-by-parent write gate into security-plugin-cbp-write-gate.ts

Cut 3 of the security-plugin.ts split, move-only. The bodies of
checkControlledByParentWrite, assertControlledByParentWrite,
assertControlledByParentChainEditable, controlledByParentPredicateWriteMasters
and assertMasterRowEditable move unedited to a new module beside it, with
MASTER_EDIT_DENIAL_LEG, controlledByParentWriteOutcomeOf, writesMasterReference
and the error imports only they read. Each method keeps its name, signature,
docblock and position and hands its body one Pick-typed host (ql and
permissionEvaluator as getters, methods as late-bound closures); the stubs
drop async and return the moved function's promise.

Five module-level values the bodies read stay in security-plugin.ts and are
exported for the module's call-time import: CBP_MAX_CHAIN_DEPTH (ADR-0055
symbol anchor), requiredCapsForOperation (spec liveness anchor), and the
three predicate-write helpers readableRowsScopeForPredicateWrite shares.
index.ts re-exports only SecurityPlugin, so the package surface is unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017BoLT8Gaa8t9a7AWVH8qZa

Author: claude