docs: close audit remediation program

[twilightsaurus]

Summary

Records formal closure of the remediation program arising from the 2026-10-03 full repository audit.

Closure

All numbered findings F01-F11 now map to landed remediations still present on current main:

• Slice 17 / PR fix: enforce atomic bounded input rejection across adapters and relay #30 — F01, F06, F07
• Slice 18 / PR fix: keep selected feeds live on unchanged state observations #31 — F02
• Slice 19 / PR fix: isolate slow relay subscribers #32 — F03
• PR test: harden gateway backpressure regression #33 — test/flakiness follow-up for Slice 19
• Slice 20 / PR fix: harden relay diagnostics and version identity #34 — F04, F11
• Slice 21 / PR fix: contain desktop-owned native runtimes #35 — F05
• Slice 22 / PR fix: make shared UI client-neutral and accessible #36 — F08, F09, F10

Slice 23 / PR #37 separately resolves the deferred ActionBroker result-timeout validation gap. It is not assigned an audit finding number.

Documentation

Adds:

• docs/audits/2026-10-05-remediation-closure.md

Reconciles:

• audit index
• project status
• roadmap
• releases documentation

The original 2026-10-03 audit remains unchanged and is treated as immutable historical evidence.

Validation

Independent review verified:

• exact F01-F11 finding/severity mapping
• PR, merge-commit, and feature-commit identities
• current-main presence of each remediation
• historical audit blob identity
• Slice 23 separation from F01-F11
• retained platform/acceptance limitations
• no stale unresolved audit claims

Final validation passed:

• docs/reference checks
• version checks
• git diff --check
• full npm run check
• protocol: 64
• desktop: 152
• relay: 226
• shared adapter: 31
• Mudlet: 32
• TinyFugue: 101
• real loopback E2E
• frontend production build

This closes the remediation program, not all possible future defects or platform validation work.