fix(security): unify verifier read policy

[1-ztc]

Summary

• share one normalized sensitive-path policy between predicate evaluation and the readonly device executor
• reject /sys/firmware/... before device execution with
  ead_path_not_allowed`n- cover both telemetry reads and device ile_exist predicates
• add an atomic security-fix checklist to the PR template

Validation

• full
  pm run verify passed
• boundaries, hygiene, benchmark checks, build, typecheck, lint, and all tests passed
• moss-agent: 227 test files passed