docs: fix guard drift in reviewer prompts and add missing README feature

reviewer-code.md was missing 4 of 17 assigned guards (LAYERS, META,
MODULE, TAXONOMY); reviewer-security.md was missing GR-SEC-010. README
did not list the Scheduled Jobs feature.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.agents/prompts/reviewer-code.md

@@ -29,6 +29,10 @@ Scope — verify these guards:
 - GR-UI-A11Y: accessibility (if UI touched)
 - GR-UI-I18N: i18n completeness (if visible text touched)
 - GR-UI-REUSE: reuse-first (if JS/CSS added)
+- GR-UI-TAXONOMY: status taxonomy consistency (if status enums/labels touched)
+- GR-CORE-LAYERS: architecture layer isolation
+- GR-CORE-META: agent and codex system integrity (if .agents/ touched)
+- GR-CORE-MODULE: module boundary isolation (if modules touched)
 
 Rules:
 - findings MUST reference a guard or gate ID

.agents/prompts/reviewer-security.md

@@ -24,6 +24,7 @@ Scope — verify these guards:
 - GR-SEC-007: API must not start sessions
 - GR-SEC-008: server-side authorization enforced
 - GR-SEC-009: server-side tenant scope enforced
+- GR-SEC-010: output escaping in views (e() required, raw echo only with // raw-html-ok marker)
 
 Rules:
 - findings MUST reference a GR-SEC-* guard ID

README.md

@@ -14,6 +14,7 @@ Der Fokus liegt auf klarer Rollen-/Rechtestruktur, Tenant-Scope und einer konsis
 - Mail-Versand (SMTP/PHPMailer) inkl. Mail-Log
 - Onboarding-PDF fuer Zugangsdaten (Single inline, Bulk als ZIP)
 - Passwort-Reset und Remember-Login-Tokens
+- Geplante Aufgaben (Scheduler mit Ausfuehrungshistorie)
 
 ## Tech Stack