fix(m3-security-balanced-recalibration): stratified recalibration with safe-label audit, balanced sample, and hygiene

- SAFE-LABEL AUDIT: Fixed 3 mislabeled near-miss items:
  sec-nearmiss-29 (div-by-zero before nitems==0 guard now fixed),
  sec-nearmiss-33 (prefix-check bypass via sibling dirs now fixed),
  sec-nearmiss-34 (same prefix bypass now fixed with boundary check)
- STRATIFIED RECALIBRATION: Built balanced calibration sample
  (10 targets + 8 near-misses + 7 distractors = 25 items),
  K_TRIALS=5, CONC=4, batch-size=2, solver claude-sonnet-4-6.
  Aggregate baseline 58.4% — in [0.40,0.70] band → in_band=true
- RE-FREEZE: Manifest item_counts verified to EXACTLY match JSONL
  (25 target, 10 near_miss, 35 distractor, 0 ambiguous = 70 total)
- HYGIENE: Untracked calib-sample scratch files via git rm --cached