Deploy/CI polish: engine missing stop_grace_period in compose; values.yaml oversells vault backend; actions tag-pinned; CLAUDE.md stale on M4

[richardmhope]

Severity: low (bundle). Found by a full-codebase review.

1. No stop_grace_period on the compose engine service (deploy/compose/docker-compose.yml:122): worker.py deliberately catches SIGTERM and finishes leased work, and Helm backs that with terminationGracePeriodSeconds: 120 — but compose uses Docker's default 10 s, so make down during an active fetch SIGKILLs the task and the scan waits out the 300 s lease before reclaim. The worker docstring's claim that SIGTERM handling makes docker compose down "a clean shutdown" is only true for idle engines. Fix: stop_grace_period: 120s to match the chart.

2. values.yaml presents vault as a working secret-store backend (deploy/helm/icebergsst/values.yaml:43): the comment reads "vault selects the Vault backend", but build_secret_store raises SecretStoreConfigError ("documented seam, not yet implemented") for that value — an operator flipping config.secretStoreBackend: vault gets every api pod CrashLooping after a successful upgrade. .env.example words it honestly; mirror that wording.

3. CI actions tag-pinned, not SHA-pinned (.github/workflows/ci.yml:19): actions/checkout@v5 and astral-sh/setup-uv@v6 float on mutable major tags in a security product's repo. Blast radius is limited by workflow-level permissions: contents: read, but the repo otherwise pins everything (uv version in Dockerfiles, gitleaks image tag, uv sync --locked). Fix: pin both to full commit SHAs with a tag comment.

4. CLAUDE.md still says notification dispatch and Helm (M4) "are still to come" (CLAUDE.md:17): both shipped (deploy/helm/icebergsst/, dispatch.py + the notification_delivery outbox, PRs api: configurable data retention for findings and audit events (#73) #102-security: threat-model review, audit coverage, and key-rotation runbooks (#64) #104). The "Where the code is" paragraph is the orientation every assistant and new contributor reads first. Fix: update it (and re-check docs/backlog.md's M4 framing).