Add STRIDE threat-model skill and Requirements Coworker persona

[KhaiTrang1995]

What

1. threat-model skill for the security persona — a design-time STRIDE
   threat model (trust boundaries, per-boundary STRIDE pass, likelihood×impact
   scoring, concrete mitigations). Complements the existing skills, which all
   scan code that already exists (semgrep-review, secret-scan); this one
   runs before there's anything to scan.
2. New requirements persona (ships: false) with a brainstorm skill —
   an evidence-only interview (one topic at a time) that turns a raw idea into
   a structured spec at docs/<feature>/brainstorms/<idea-slug>.md. Vague or
   missing answers become <!-- TBD --> + an Open Question instead of an
   invented number/wording — never fills gaps with a plausible default.

Why

• The security persona currently only reviews code that already exists.
  Threat modeling before implementation is a natural, low-risk extension —
  it's pure reasoning (no tool to drive), so it doesn't touch the
  drive-a-real-scanner contract the other skills are pinned to
  (tests/test_security_bundles.py::test_prompts_carry_the_positioning_guardrails
  etc.).
• requirements/brainstorm fills a gap in the "Everyday work" use case from
  the README ("turn scattered notes into a shippable plan") — there's
  currently no persona for requirements-gathering. It ships false and is
  staged internal-only, same as other candidate personas (swe-lead,
  appsec-worker, …) — this PR does not touch the release lineup
  (test_release_lineup), that's an explicit product call for a maintainer
  to make.

Changes

• coworker/personas/builtin/security/skills/threat-model/SKILL.md (new)
• coworker/personas/builtin/security/manifest.md — add threat-model to
  skills:, one line in the system prompt pointing to it
• coworker/personas/builtin/requirements/manifest.md (new, ships: false)
• coworker/personas/builtin/requirements/skills/brainstorm/SKILL.md (new)
• tests/test_security_bundles.py — add threat-model to the security
  bundle's expected skill set
• tests/test_persona_registry.py — add requirements to the expected
  internal-build sidebar set
• .gitignore — ignore untrack/ (local scratch)

Testing

• Both manifests parse and pass validation through
  coworker.personas.manifest.load_manifest_file (tool names checked
  against the real CATALOG).
• Both skill folders load correctly via coworker.skills.base.SkillLoader.
• tests/test_persona_registry.py: 12/12 pass.
• tests/test_security_bundles.py: the assertions that don't require the
  full SessionManager stack were reproduced and pass; I could not get the
  project's pinned aisuite fork installed in my sandbox to run the full
  suite (test_bundle_skills_stay_with_their_persona needs it) — would
  appreciate a CI/maintainer run to confirm that one