docs(rules): add Security section to self_review_checklist (follow-up to #3359)

[realmeylisdev]

Description

Small follow-up to PR #3784 (Phase 1 of #3359). Captures the
investigation lesson in the project's pre-PR checklist so future
reviewers see the rule before it bites again.

Two additions to .claude/rules/self_review_checklist.md:

1. Testing bullet — flags tests that pin a security-sensitive
   leak as a feature (e.g. expect(verifier, endsWith('.nsec1...'))).
   The pre-fix BYOK leak was hidden behind exactly this shape for the
   lifetime of the imported keycast_flutter package.
2. Security section — points reviewers at the new
   nsec-leak-guard CI script and asks the local-custody question
   for any new credential / secret handling.

Related Issue: Relates to #3359 (already closed by PR #3784 merging will close it)

No code changes. No tests changes. Docs only.

Type of Change

• 📝 Documentation

Test plan

• Diff is 20-line addition to a single Markdown file; no behavior change
• Headings preserve the existing checklist structure (item under "Testing", new "Security" section between "Testing" and the divider)

[hm21]

We can do that, but right now I’m not completely happy with the large number of rules we have. The problem is that they’re sent with every request, which quickly fills up the context window, even in cases where those rules aren’t really needed. That’s why I like skills, especially the review skill, since things like this can be cleaned up once the code scaffold is in place.

It’s probably not a blocker at the moment, even though the rules are quite extensive, but in the future it might make sense to rethink what actually needs to be included in every session and what should only run during code review.

[realmeylisdev]

Thanks — your framing clicked. The cleanest move here is probably to drop the self_review_checklist.md addition from this PR rather than land it. The 20 new lines are review-time content (a test-pinning anti-pattern + a security implementation question), so they'd land more naturally inside /review-before-commit than in the always-loaded checklist you flagged as already heavy.

Wrote up the broader trajectory at mobile/docs/brainstorm/2026-05-01-claude-rules-context-cost-brainstorm.md plus a concrete first migration step (state_management.md → /state-management-help skill) as a follow-up plan. About to force-push the branch back to its parent so the diff goes empty; happy to close once you've had a look. The security / test-pin lessons reland in /review-before-commit once that migration's underway — sound good?

[NotThatKindOfDrLiz]

@realmeylisdev If this is now closed, can we go ahead and delete the branch or are you going to cherrypick from it elsewhere? Just want to keep the repo as clean as we can. TYSM!

[realmeylisdev]

Already deleted — branch was force-pushed back to parent before close so it had zero commits on it; nothing to cherrypick literally. The content (Security section + test-pinning bullet) relands in a future /review-before-commit skill migration per the PR closing comment. Thanks for the nudge to clean up!