fix(audit): update remediation-plan checkbox states for closed issues

[mvillmow]

Summary

Corrects stale checkbox states in the audit remediation plan for 10+ already-closed issues. Marks completed items as [x], adds missing #85 entry to Wave 1, and introduces a regression test to prevent future checkbox drift.

Changes

• Mark Wave 1 issues [CRITICAL] §6: Gitleaks secrets scan configured with continue-on-error — never blocks #86 and [CRITICAL] §6: Trivy scan configured with exit-code 0 — never fails the build on CVEs #85 as completed [x] in remediation-plan.md
• Mark Wave 2 issue [CRITICAL] §3: Cross-repo dispatch reads client_payload.host but AchaeanFleet never sends it #84 as completed [x]
• Mark Wave 3 issues [MAJOR] §7: @dagger.io/dagger version range too permissive for a toolchain dependency #96, [MINOR] §7: typescript devDependency range too permissive — allows TypeScript 6.x breaking changes #107–[MINOR] §15: LICENSE copyright year 2025 is stale — audit date is 2026-04-28 #115, [NITPICK] §4: lint() returns concatenated strings rather than separate functions per linter #118, [NITPICK] §8: SECURITY.md uses personal GitHub noreply email as security contact #120 as completed [x]
• Add structural regression test (remediation-plan-checkboxes.test.sh) to catch stale checkbox states
• Wire test into CI via _required.yml

Testing

• Verify all closed issues (per GitHub API) are marked [x] in remediation-plan.md
• Confirm regression test passes: ./tests/remediation-plan-checkboxes.test.sh
• Confirm CI job runs and passes on push

Closes

Closes #186

Generated by Claude Code via ProjectHephaestus automation.

[mvillmow]

Doc correction + offline test are correct and complete, but err.txt (a transient dispatch-apply test artifact) was committed to repo root — unrelated to #186, must be removed.

[mvillmow]

This file is a transient artifact, not an intended deliverable. It is written by tests/dispatch-apply.test.sh:37 (2>err.txt) to the current working directory and was accidentally git added in this PR. It is unrelated to issue #186 and pollutes the repo root. Remove it from the commit (git rm err.txt), add err.txt to .gitignore, and ideally redirect the source test to a mktemp path so the artifact can never be committed again.

[mvillmow]

The EXPECTED fixture and the Wave-3 group # CLOSED/OPEN comments are a point-in-time snapshot of GitHub state. If any tracked issue is later reopened, this test will silently keep passing against a now-stale doc until someone manually re-runs the RE-VERIFY command — the guard cannot detect that drift. The RE-VERIFY note documents the refresh procedure but nothing enforces it. Acceptable given the offline-hermetic tradeoff, but worth noting the guard protects against doc-vs-fixture drift, not fixture-vs-GitHub drift.