test(settings): re-pin security-webhooks nav lock for the revised commercial posture

The commercial-surfaces revision (f0e2243b4) made security-webhooks
relay-shaped: the catalog entry dropped hideWhenUnavailable so the tab
stays visible for free installs with a panel-owned inline gate, and the
tab already carries a tabFeatureRequirements entry, so
isSettingsNavItemLocked now honestly reports it locked. The
settingsNavigation.integration.test.tsx gatedTabs pin was re-pinned by
the revision; the branchcov2 never-locked pin was not, and has been
failing on main since.

Re-pin to the revision's intent rather than flipping the assertion:
give security-webhooks a dedicated locked pin mirroring system-relay's,
drop it from the never-locked list, and refresh the two comments that
still claimed security-roles and friends carry hideWhenUnavailable
(only the organization-* tabs still do; the security-roles assertion
now exercises the no-requirements branch, so it was swapped for
organization-access to keep the early-branch coverage honest).

frontend-modern/src/components/Settings/__tests__/settingsNavVisibility.branchcov2.test.ts

@@ -442,8 +442,9 @@ describe('isSettingsNavItemLocked', () => {
   });
 
   it('returns false for a tab with hideWhenUnavailable (early `item.hideWhenUnavailable` branch)', () => {
-    // organization-overview, security-roles, system-relay, support-reporting all
-    // carry hideWhenUnavailable -> short-circuit before isTabLocked is consulted.
+    // Since the 2026-08-07 commercial-surfaces revision only the organization-*
+    // tabs still carry hideWhenUnavailable -> short-circuit before isTabLocked
+    // is consulted.
     expect(
       isSettingsNavItemLocked(
         'organization-overview',
@@ -451,7 +452,10 @@ describe('isSettingsNavItemLocked', () => {
       ),
     ).toBe(false);
     expect(
-      isSettingsNavItemLocked('security-roles', createContext({ hasFeature: hasFeatures([]) })),
+      isSettingsNavItemLocked(
+        'organization-access',
+        createContext({ hasFeature: hasFeatures([]) }),
+      ),
     ).toBe(false);
   });
 
@@ -467,6 +471,21 @@ describe('isSettingsNavItemLocked', () => {
     ).toBe(false);
   });
 
+  it('reports security-webhooks as locked for free installs (visible nav item, panel-owned gate)', () => {
+    // Relay-shaped since the 2026-08-07 commercial-surfaces revision: the
+    // catalog entry dropped hideWhenUnavailable so the tab stays visible and
+    // the panel gates inline, so the lock state reports honestly.
+    expect(
+      isSettingsNavItemLocked('security-webhooks', createContext({ hasFeature: hasFeatures([]) })),
+    ).toBe(true);
+    expect(
+      isSettingsNavItemLocked(
+        'security-webhooks',
+        createContext({ hasFeature: hasFeatures(['audit_logging']) }),
+      ),
+    ).toBe(false);
+  });
+
   it('returns false for a tab without feature requirements (isTabLocked -> isFeatureLocked false branch)', () => {
     expect(
       isSettingsNavItemLocked('system-general', createContext({ hasFeature: hasFeatures([]) })),
@@ -482,12 +501,12 @@ describe('isSettingsNavItemLocked', () => {
     ).toBe(false);
   });
 
-  it('never reports other real catalog tabs as locked (their feature gates also carry hideWhenUnavailable)', () => {
-    // system-relay is the one deliberate exception: it stays visible without the
-    // relay feature and reports locked (see the dedicated test above). Every
-    // other feature-gated tab still hides instead of locking.
+  it('never reports other real catalog tabs as locked', () => {
+    // system-relay and security-webhooks are the two deliberate exceptions:
+    // they stay visible without their feature and report locked (see the
+    // dedicated tests above). The organization-* tabs still hide via
+    // hideWhenUnavailable, and the rest carry no lock requirements.
     const tabs: SettingsTab[] = [
-      'security-webhooks',
       'organization-overview',
       'organization-access',
       'organization-sharing',