docs: align public preview status and README

[Nobodyworld]

Summary

Aligns public-facing documentation with the merged execution and exact-SHA evidence foundation, while replacing stale permanent validation claims with durable links to authoritative evidence.

Exact branch state

base/main: dcb8e283f8445dd76f215a98023197d8ed5acab3
head: fa9667dd04d95b5e7c899d4e16ce22d1790c7ae8
branch: docs/public-preview-status-actions
ahead of main: 4 commits
behind main: 0
merge base: dcb8e283f8445dd76f215a98023197d8ed5acab3
changed files: 4 documentation files

This PR supersedes closed coordination PRs #123 and #124. No force-push or policy weakening was used. The final branch was recreated directly from current main through normal contents-API commits so GitHub Actions evaluated the actual commit range.

Changes

• README.md describes the merged trusted local worker and compact exact-SHA evidence workflow without permanent test-count or coverage claims.
• SECURITY_NOTES.md classifies dated findings as historical, removes the stale current-tense Mypy warning, and links current local-worker trust guidance.
• docs/TASKLIST.md records feat(evidence): add exact-SHA validation evidence #120 as merged, preserves the remaining Linux/Docker release gate, and records feat(github): request exact-PR validation and publish compact evidence #122 followed by feat(evidence): reuse exact validation evidence with local availability proof #121.
• docs/reports/status.md records the merged evidence baseline, links operator guidance, preserves the developer-preview classification, and states that no release candidate has yet been selected.

Scope

Documentation only. No runtime, dependency, workflow, repository-setting, release, or security-control behavior changes.

Hosted validation

Final-head workflows:

• Commitlint 29991444435 — success;
• CI 29991444455 — success.

The complete matrix passed:

• lint/pre-commit and TODO validation;
• Mypy/typecheck;
• full pytest;
• security and dependency scanning;
• full-history Gitleaks;
• link validation;
• coverage and configured thresholds;
• strict browser UI tests.

Merge boundary

Connector review is complete and no review threads are open. This PR is ready for normal owner merge gating but remains unmerged. If approved, use squash merge at the exact expected head SHA above. The resulting main SHA is the recommended release-candidate anchor for issue #104.

[Nobodyworld]

Final connector review completed.

The branch is exactly four conventional documentation commits ahead and zero behind main; the merge base is dcb8e283f8445dd76f215a98023197d8ed5acab3. The diff is limited to README.md, SECURITY_NOTES.md, docs/TASKLIST.md, and docs/reports/status.md, with no runtime, dependency, workflow, release, or repository-setting changes.

Commitlint 29991444435 and complete CI 29991444455 succeeded, including lint/pre-commit, TODO validation, Mypy, full pytest, security, Gitleaks, links, coverage thresholds, and strict browser tests. No review threads are open.

No connector-review blockers remain. Keep the PR unmerged until explicit owner authorization; if approved, squash-merge only at expected head fa9667dd04d95b5e7c899d4e16ce22d1790c7ae8.