fix(tick): groom again when an issue changes after its contract

[mike-diff]

Problem

Found in a live run on ghafk-dashboard #18: an outsider's issue was approved with /start and groomed, then the outsider edited the description. ghafk correctly parked it for a new /start. After re-approval, ghafk skipped grooming and built the contract written from the old text, so the edited requirement never reached the contract. The same gap applies to an owner's issue edited after grooming.

Change

• The card records a digest of the issue title and description the contract was groomed from (groomed in the card state).
• A tick grooms again when the current text no longer matches that digest, instead of starting the worker on the old contract.
• Cards written before this change have no digest and keep their contract, so issues already in flight are not re-groomed.
• docs/security.md says so.

Verification

• Tick-level tests: an issue edited after grooming runs the groomer and not the worker; an unchanged issue goes to the worker with its contract; a card without a digest keeps its contract. Grooming records the digest of the text it was given.
• Each test fails when its part of the fix is removed.
• vet, gofmt and staticcheck clean on Linux and macOS; full suite passes.