* fix(ci): stop obsolete security reviews after PR lifecycle changes * fix(ci): preserve security review evidence after merges