fix: keep original security code in position key while normalizing for conflict detection

- _buffer_order now preserves the original security string for position keys
- _normalize_security is only used for mixed-order-type conflict detection
- Prevents position key mismatch when bare vs suffixed codes are used interchangeably

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>