feat(kvb-check-security): accept takes every rule of a line; acceptance only after kvb-think-criticize

MEDUSA often fires several rules on one line (14 INF-SCAN rules on one tempfile line), so security.py accept now takes --rule repeatedly and appends one row per rule, same id formula, in one locked write; a single --rule works as before. The skill now allows an acceptance only once kvb-think-criticize judged the finding a false positive or by design, per the operator's order of 2026-11-05.

🎯 Fix: 96 %
💥 Break: 2 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 94
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_security.py

@@ -163,6 +163,18 @@ class TestSecurity(unittest.TestCase):
         self.assertEqual(result.returncode, 2)
         self.assertIn("--sha1 must be 40 lowercase hex digits", result.stderr)
 
+    def test_one_accept_takes_every_rule_of_a_line(self):
+        line = "z = both()  # MARK-HIGH MARK-LOW"
+        self.write("app.py", f"{line}\n")
+        sha1 = hashlib.sha1(line.encode()).hexdigest()
+        result = self.accept(
+            "--rule", "FAKE-HIGH", "--rule", "FAKE-LOW", "--path", "app.py", "--sha1", sha1, "--reason", "fixture"
+        )
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("accepted FAKE-HIGH, FAKE-LOW app.py", result.stdout)
+        result = self.scan(env=self.env)
+        self.assertEqual(result.stdout, "🛡️ security 100 % (medusa: 0 findings, 2 accepted in 1 file)\n")
+
     def test_critical_exits_1_and_floors_at_0(self):
         self.write("app.py", "a  # MARK-CRITICAL\nb  # MARK-CRITICAL\nc  # MARK-CRITICAL\n")
         result = self.scan(env=self.env)