chore(agents): sync agent configs, models, capability index; cleanup junk

- Update agent model assignments (minimax/glm -> nemotron-3-ultra, kimi-k2.7-code, qwen3.5:397b) in .kilo/agents, kilo-meta.json, kilo.jsonc, capability-index.yaml
- Update orchestrator/agent prompts (complexity fast-path, verification tests, close-loop audit)
- Add .kilo/KILO_SPEC.md (Kilo Code specification reference)
- AGENTS.md: consolidate smartadmin agent rows
- Remove screenshot-dash.cjs (unused, contained hardcoded admin token); gitignore it
- Remove empty .kilo/milestones/

.kilo/agents/security-auditor.md

@@ -1,10 +1,11 @@
 ---
 description: Scans for security vulnerabilities, OWASP Top 10, dependency CVEs, and hardcoded secrets (GNS-2 Tier 0)
 mode: all
-model: ollama-cloud/glm-5.2
+model: ollama-cloud/kimi-k2.7-code
 variant: thinking
 color: "#DC2626"
 permission:
+  write: ask
   edit: allow
   read: allow
   bash: allow
@@ -205,4 +206,15 @@ After completion, recommend next agent in event footer:
 - `security-auditor`: after performance reviewed
 
 
+## Verification Test Generation
+
+When vulnerabilities are found, the auditor MUST emit a verification test (e.g., a request that should be rejected) that would have caught the vulnerability. These are included in the GNS_EVENT footer as `verification_tests`.
+
+```bash
+# Example: verification test for SQL injection
+# curl -X POST /api/login -d "username=' OR 1=1--" | should return 400
+```
+
+Each entry: `{test_name, test_code, catches}` — describes the vulnerability it catches.
+
 <gitea-commenting required="true" skill="gitea-commenting" />