Security review gets a markdown-only final reply and a tip for the Claude Security plugin

What

The security-review command and the tips around it changed:

• Final reply: the command now ends with the instruction "Your final reply must contain the markdown report and nothing else." In normal top-level runs, lines from a closing tip are added before that instruction. Before, there was no instruction about the final reply.
• Closing tip: a new step loads a security-review closing tip. It is skipped when spinnerTipsEnabled is false.
• Plugin tip: a new tip, shown next to the spinner while Claude works, suggests installing the Claude Security plugin with /plugin install. It reads "Looking to improve the security of your code? Install the Claude Security plugin" or "Tip: For a deeper, verified scan, install the Claude Security plugin:". It only shows when all of these hold:
  • the remote setting tengu_noble_piglet has security_review_tip set to true (nothing has been read about this setting);
  • spinner tips are enabled;
  • the plugin is not installed yet;
  • the tip has not been shown too recently;
  • security review was used recently or a security-check score is high.

Why

The review's last message is now just the report, which is easier to read or copy. Some users may see a suggestion to install the Claude Security plugin. Setting spinnerTipsEnabled to false hides these tips.