fix: make audit gates evidence-backed and correct stale check-count claims

- wire npm audit (prod + full dev tree) through readGate instead of hardcoded NOT RUN reasons
- record real results: production 0 vulns PASS; dev tree 16 dev-only advisories FAIL, disclosed with reach and remediation
- docs/VERIFICATION.md: six checks -> seven, add package-metadata section and mutation row, record executed row-7 proof
- README/SETTINGS: replace six-gate wording with the actual gate ledger

RELEASE.json

@@ -20,7 +20,7 @@
     "themes": 2,
     "behavioralTests": 9,
     "sourceFilesHashed": 97,
-    "sourceBytesHashed": 311578,
+    "sourceBytesHashed": 313817,
     "selfHashPolicy": "RELEASE.json is excluded from its own source inventory; final package and archive hashes are recorded externally."
   },
   "verification": {
@@ -97,12 +97,52 @@
       }
     },
     "productionDependencyAudit": {
-      "status": "NOT RUN",
-      "reason": "Requires network access to npm registry"
+      "status": "PASS",
+      "timestamp": "2026-08-19T11:33:59+02:00",
+      "scope": "production dependency audit",
+      "command": "npm audit --omit=dev --registry=https://registry.npmjs.org/",
+      "details": {
+        "passed": true,
+        "timestamp": "2026-08-19T11:33:59+02:00",
+        "scope": "production dependency audit",
+        "command": "npm audit --omit=dev --registry=https://registry.npmjs.org/",
+        "vulnerabilities": {
+          "info": 0,
+          "low": 0,
+          "moderate": 0,
+          "high": 0,
+          "critical": 0
+        }
+      }
     },
     "fullDevelopmentTreeAudit": {
-      "status": "NOT RUN",
-      "reason": "Requires network access to npm registry"
+      "status": "FAIL",
+      "timestamp": "2026-08-19T11:34:04+02:00",
+      "scope": "full development tree audit",
+      "command": "npm audit --registry=https://registry.npmjs.org/",
+      "details": {
+        "passed": false,
+        "timestamp": "2026-08-19T11:34:04+02:00",
+        "scope": "full development tree audit",
+        "command": "npm audit --registry=https://registry.npmjs.org/",
+        "vulnerabilities": {
+          "info": 0,
+          "low": 0,
+          "moderate": 9,
+          "high": 7,
+          "critical": 0,
+          "total": 16
+        },
+        "packages": [
+          "adm-zip (high)",
+          "fast-xml-parser (high)",
+          "sharp (high, libvips CVEs)",
+          "@opentelemetry/core (moderate)",
+          "tar (moderate)"
+        ],
+        "reach": "dev-only; every advisory is transitive under the @oh-my-pi/* peer SDK. npm audit --omit=dev reports 0 vulnerabilities, so no advisory reaches the published tarball (runtime deps are crc-32, yauzl, yazl).",
+        "remediation": "none available in-window: npm audit fix --dry-run changes 0 packages and still reports 16. Requires an upstream @oh-my-pi release; forcing it would leave the >=16.4.6 <17 peer window."
+      }
     },
     "ompPluginDoctor": {
       "status": "NOT RUN",
@@ -142,8 +182,8 @@
     },
     {
       "path": "README.md",
-      "bytes": 9804,
-      "sha256": "3e444309f69a35f8e57bbcda88956a5db6ec6fd6d2621fbb67b50a718335ad8f"
+      "bytes": 10547,
+      "sha256": "75b9c26fc6a028575506b1da6df84c20a72323b58ba4acc53f801e9817bf9d5e"
     },
     {
       "path": "agents/pom-architect.md",
@@ -277,8 +317,8 @@
     },
     {
       "path": "docs/SETTINGS.md",
-      "bytes": 3072,
-      "sha256": "33bf545df6b85c03ed2512a01c78fff7191f1fcd3b5cb216055d53aa549c6d7d"
+      "bytes": 3229,
+      "sha256": "9226d0ad0bbb07d49dd8bd06c21febba2166145c1822e58cd621e9b6f472d605"
     },
     {
       "path": "docs/TOOL_MATRIX.md",
@@ -292,8 +332,8 @@
     },
     {
       "path": "docs/VERIFICATION.md",
-      "bytes": 10255,
-      "sha256": "0aab7e070ea90dbca30a0ed86a9afdedd2a26707ff359e09cc5f360b2e8a47a9"
+      "bytes": 11486,
+      "sha256": "dfd5c5dd0cadaf5e5e018ebd8d74a0ab718835ec46ad9163e79c91f6dd275a30"
     },
     {
       "path": "docs/index.md",
@@ -407,8 +447,8 @@
     },
     {
       "path": "scripts/release-manifest.mjs",
-      "bytes": 4714,
-      "sha256": "13dac5093fae178d34484f3bd374f34dbf450e84ea994bb5a0258dfcce5ac541"
+      "bytes": 4822,
+      "sha256": "ca0027d77c2277beeb283c567f9e618a4921b388c863dbb8e81dc381da7e58da"
     },
     {
       "path": "scripts/smoke.ts",