docs: record the Dependabot round closure, the declined display-name decision, and the governance re-verification

[tyler-rich]

Summary

The durable record for the 2026-08-09 round that finished the open Dependabot queue, plus the documentation corrections that round surfaced. Docs-only — no code, schema, CI-behavior, or dependency change.

What changed

• docs/ARCHIVE.md gains the dated §14 entry covering the round end-to-end: the merge order and per-merge CI verification for deps: reapply the mergeable half of #157 and record the Dependabot queue audit #159/docker: bump debian from 7b140f3 to abd67ff in /docker in the docker-images group #151/ci: bump the github-actions group with 2 updates #154/deps: bump bundled scanners to trivy 0.73.0, grype 0.116.1, syft 1.50.0 #160/docker: bump aquasec/trivy from 0.72.0 to 0.73.0 in /docker in the docker-images group #150; the closures (ci: bump cryptography from 49.0.0 to 50.0.0 in /backend in the pip group across 1 directory #149 after verifying fix(deps): bump cryptography 49.0.0 -> 50.0.0, closing CVE-2026-69247 #156's supersession in the dev diff, backend: bump the backend-dependencies group across 1 directory with 2 updates #157, deps: reapply the mergeable half of #157 and record the Dependabot queue audit #158 replaced by deps: reapply the mergeable half of #157 and record the Dependabot queue audit #159 from a renamed branch, with the mechanics corrections); the DECLINED profile-display-name decision, written so a future reader does not re-raise it; the verified-unchanged alembic timing claim (PyPI: 1.19.1 published 2026-08-08T16:32Z, ~7h after backend: bump the backend-dependencies group across 1 directory with 2 updates #157 opened — the entry was right as written); the re-verified ignore-list-read-from-main finding with its options and costs, deliberately left; the live governance/ruleset re-verification (including two settings edits found done that nothing recorded — the CodeQL contexts are required on both rulesets and default setup is off); the sandbox-interpreter resolution (3.14.6 installs via a current uv; full suite 728 passed / 11 skipped; the 3.13 pathlib failure re-reproduced exactly as the 2026-08-03 entry records); and the environment's footer-append behavior on GitHub API writes.
• docs/ROADMAP.md — the governance checklist now records the display name as declined, not deferred (web-UI/API merge commits are correct as they stand), re-dates what was re-verifiable on 2026-08-09, reduces the CodeQL item to alert disposition only, and names frontend: bump the frontend-dependencies group in /frontend with 13 updates #153 as the frontend: bump the frontend-dependencies group across 1 directory with 25 updates #86 sweep's open, deliberately unactioned Dependabot expression.
• CLAUDE.md § Git & PR conventions — the sentence requiring the profile display name to read tyler-rich is replaced with the declined decision, so the rules document and the decision agree. (This file was not named in the round's scope; it is included because it is read first every session and would otherwise keep re-raising the closed question.)

Verification

• Every governance claim in the diff was read from the live API this session (ruleset contents, GHCR anonymous pull, private vulnerability reporting), not carried forward.
• §14 index updated (139 → 140) with the new entry's anchor verified against GitHub's slug rules.