ci-secure: remove vestigial sibling-skill code and give "the ten" a single source of truth

Two maintainability items from the launch review, grouped:

1. Vestigial sibling-skill code (~400 lines). scripts/gh_utils.py, scripts/config.py, and scripts/scan.py carry helpers and constants inherited from the sibling skills that ci-secure's own pipeline never exercises. They add surface area to read and maintain with no runtime effect. Ask: audit the three modules and delete what ci-secure does not call (guarded by the existing suite).

2. "The ten" has no single source of truth. The catalog's approved pattern set is currently restated in several places — THE_TEN in tests/verify_report.py, THE_TEN in tests/test_census_why_these_ten.py, the catalog itself, and why-these-ten.md. A census test binds them today, but the set is duplicated rather than derived. Ask: pick one authoritative definition (most likely the catalog's loaded pattern set) and have the others derive from it, so adding/removing a vector touches one place.

Found during the ci-secure launch-readiness review (panels P9, P10).