chore(override-vocab): narrow 'recovery' scope to git-recovery only

Reduces 'recovery' suppresses 5→2 categories. Removes graph-first /
chain-recommendation / semgrep-security side-effects.

Driver: brain-retro #10 trend analysis — 'recovery' fired 525 times
on 2026-05-28 (vs 10/day baseline 25.05). Per Level 1 plan
docs/superpowers/plans/2026-05-28-router-discipline-level-1-2.md.

Also updates enforce-semgrep-security.test.mjs: flips the 'recovery'
suppresses-semgrep-security test to assert the new correct behaviour
(recovery does NOT suppress semgrep-security).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tools/enforce-override-vocab.json

@@ -54,12 +54,9 @@
       "phrase": "recovery",
       "suppresses": [
         "branch-switch",
-        "git-recovery",
-        "graph-first",
-        "chain-recommendation",
-        "semgrep-security"
+        "git-recovery"
       ],
-      "description": "Git recovery operation, branch-state mismatch ok"
+      "description": "Git recovery only — branch-state mismatch ok. Does NOT suppress graph-first / chain-recommendation / semgrep-security (use specific phrases for those)."
     },
     {
       "phrase": "memory dump",

tools/enforce-semgrep-security.test.mjs

@@ -165,9 +165,9 @@ describe('override vocab coverage', () => {
     const o = findOverride("быстрый коммит", 'semgrep-security');
     expect(o).toBeTruthy();
   });
-  it("global override \"recovery\" suppresses semgrep-security", () => {
+  it("global override \"recovery\" does NOT suppress semgrep-security (git-only scope)", () => {
     const o = findOverride("recovery", 'semgrep-security');
-    expect(o).toBeTruthy();
+    expect(o).toBeFalsy();
   });
   it("global override \"memory dump\" suppresses semgrep-security", () => {
     const o = findOverride("memory dump", 'semgrep-security');