Reconcile final maintenance security state

[ashfame]

Change

Reconcile every baseline alert against the final integration lock, record current residual causal paths and audit-only advisories, close stale child/branch status records, and add the automated and manual handoff checklist.

Root cause

Child-stage alert wording no longer reflected later compatible lock refreshes, while GitHub continues to show default-branch alerts until the draft integration PR reaches trunk. A final range-, scope-, and path-aware reconciliation was required to distinguish real lock resolution from residual or scanner-hidden risk.

Affected alerts

All 124 baseline rows are revalidated. The final integration lock resolves 84 rows and retains 40 affected rows: 26 WPS, five React Router, three Concurrently plus WPS, two block-library, two Babel plus WPS, one web-ext, and one web-ext plus WPS. Alert 171 is lock-resolved but retains the documented Playground bundled-source blocker. Seven current npm-audit GHSAs are also recorded without inventing GitHub alert numbers.

Impact

This documentation-only child changes no manifest, lockfile, application source, configuration, generated schema, public API, stored data, behavior, or license metadata. It makes clear that functional automation passes but security acceptance remains blocked by 40 baseline rows, seven audit-only advisories, and the hidden Playground source risk.

Checks

• Live Dependabot 124 open / zero dismissed / no new numbers
• Range-, scope-, and path-aware 84 resolved / 40 residual reconciliation
• All 25 residual package/version explanations
• Seven audit-only GHSA path mappings
• Node 24 clean install, schema-aware type-check, JS/style lint, Firefox and Chrome production builds
• Packaged-reference validation and exact Firefox lint gate
• npm audit 111 effects across 60 GHSAs
• Composer locked audit clean
• Verified child PR merge states and exact five-head branch state
• Approved plan prefix, 124-row appendix, unwrapped Markdown, and git diff checks
• Independent review: approved

The integration PR remains draft and unmerged for manual testing and explicit residual-risk decisions.