docs: add repository cleanup audit (issues, docs inventory, deferred work)

[tyler-rich]

Summary

Adds docs/reviews/CLEANUP-AUDIT.md, a read-only audit of the repository's open issues, the full docs/ tree, deferred work buried in docs/ARCHIVE.md §14, and general hygiene. This PR adds one file and changes nothing else — no issue was closed, no document amended, no file deleted or moved. Every proposal is written to be approved or rejected line by line.

What changed

One new file: docs/reviews/CLEANUP-AUDIT.md.

The audit is organized in four parts, led by a "recommended actions, highest value first" table.

Part 1 — Open issues. True status of all five open issues, determined against the code on dev at 96264fb and cited at file:line, not against issue state. The default branch is main while PRs target dev, so GitHub's closing keywords never fire and open-ness carries no information:

• Evaluate migrating the Docker socket proxy from tecnativa to wollomatic/socket-proxy #63 (wollomatic socket proxy) — RESOLVED in feat(docker): migrate socket proxy to wollomatic, pin allowlist to GET /images/json #89; verified at docker/docker-compose.yml:140 plus seven regression tests, and the last acceptance item (a live Docker-capable host run) was discharged on 2026-07-26.
• A stale pre-login refresh() can wipe a just-completed login() #83 (stale refresh wipes a login) — RESOLVED in fix(frontend): stop an in-flight refresh from clearing a completed login (#83) #87; verified at frontend/src/auth/AuthContext.tsx:78-83 with five jsdom cases.
• Group A CPython interpreter CVEs on 3.14 — accepted risk until the next 3.14.x point release #98, CVE-2025-15367 (poplib) — accepted risk on any interpreter below 3.15 #52 — live waiver trackers, correctly open, bodies verified current.
• [image-rescan] Fixable HIGH/CRITICAL CVEs in ghcr.io/tyler-rich/scrye:latest #75 — genuinely open; :latest is still v0.1.0 from 2026-07-09 and is 17 days of security work behind dev.

Part 2 — docs/ inventory. Every file and folder under docs/ recursively (18 files, ~430 KB) with size, last meaningful update from git history, purpose, and a KEEP / ARCHIVE / DELETE disposition. Confirms STATUS.md §1 is empty and argues it is now a historical artifact except for two operational follow-ups that should move to ROADMAP.md. Proposes deleting docs/upgrades/python-3.14.md and the folder, and flags every other document still carrying the superseded CVE-2025-15366 claim — including CHANGELOG.md lines 18-23, which is user-facing release-note text. Each proposed DELETE or ARCHIVE lists its full inbound-reference blast radius from a repo-wide grep, including code comments in .github/dependabot.yml. Ends with a proposed docs/ structure and a disposition for the audit file itself.

Part 3 — Deferred work in §14. Consolidated list of everything still outstanding, each with its source entry date, separating items with a live tracking reference from the three recorded in prose only (repo Settings work from 2026-07-06 and 2026-07-09 that never reached the ROADMAP governance checklist). Cross-checked against ROADMAP.md and the open issues so nothing is double-counted; ten previously-deferred items verified as since closed.

Part 4 — Other cleanup. ARCHIVE.md navigability, including a structural defect: fourteen dated deviation entries covering 2026-07-09 through 2026-07-26 sit underneath the ## Build performance heading rather than §14, plus one dead in-file link at ARCHIVE.md:1004. Four ROADMAP.md items now done, one of which states something false about the secret-store AAD binding. The four accumulated Unreleased changelog entries and why a v0.2.0 promotion is warranted, including the operational cost of main being 30 commits behind. 33 merged remote branches verified safe to prune, with the six PR-less review branches verified by content diff. Four aging Dependabot PRs. Proposed wording for two unrecorded CLAUDE.md operational rules (stacked-PR retargeting needs git rebase --onto; on: pull_request default types exclude edited, so a base change never re-runs CI).

The appendix states the verification method and explicitly lists what was not verified: the specific CVE list behind #75, and all GitHub repository settings.

Notes

• Docs only — no application code, CI, configuration, schema, security-model, job-model, or auth change.
• No docs/ARCHIVE.md § Deviations entry: this PR only adds an audit document and implements none of its recommendations. The deviation entry belongs with whichever proposals are accepted and acted on.
• Not for merge until the proposals have been reviewed.