fix: make audit gates evidence-backed and correct stale check-count claims

- wire npm audit (prod + full dev tree) through readGate instead of hardcoded NOT RUN reasons
- record real results: production 0 vulns PASS; dev tree 16 dev-only advisories FAIL, disclosed with reach and remediation
- docs/VERIFICATION.md: six checks -> seven, add package-metadata section and mutation row, record executed row-7 proof
- README/SETTINGS: replace six-gate wording with the actual gate ledger

TASKLIST.md

@@ -112,7 +112,7 @@ Purpose: publish only after package truth, docs truth, automation, and live veri
 
 Publication changed the facts behind several items above. Status recorded, not silently ticked:
 
-- 1.2.3 and 1.3.1 are OBSOLETE, not open: the internal-Artifactory blocker is gone. The lockfile's `resolved` URLs were repointed from the dead mirror to `registry.npmjs.org` (integrity hashes and version pins untouched), `npm install` succeeded, and all six repository-local gates were rerun green afterwards. Manifest freshness and verification truth now agree.
+- 1.2.3 and 1.3.1 are OBSOLETE, not open: the internal-Artifactory blocker is gone. The lockfile's `resolved` URLs were repointed from the dead mirror to `registry.npmjs.org` (integrity hashes and version pins untouched), `npm install` succeeded, and every repository-local gate was rerun afterwards. Both `npm audit` scopes are now evidence-backed too: production 0 vulnerabilities (PASS), full development tree 16 dev-only transitive advisories (FAIL, disclosed, no in-window remediation). Manifest freshness and verification truth now agree.
 - 7.2.3 stays PARTIAL: the Linux half is done — `check-docs` check 5 link-and-orphan PASS, wiki builds via `dev/wikis/build.sh pom`, and `https://wiki.pom.loca.zone/` plus deep pages return 200. The macOS/ego live roast remains platform-blocked (section 6).
 - 7.3.2 stays OPEN for the ego-audit clause only. Every other clause is satisfied: `prompts/` ships, `RELEASE.json` is evidence-backed from `00_admin/validation/`, docs index and wiki exist and are served, stale claims are corrected, and package metadata is live rather than reserved.
 - Publication facts: self-hosted Gitea (loopback 51400) serves `https://git.omp.loca.zone/jamminrebel/pom-omp.git` with anonymous HTTPS clone; `main` and `v2.0.0` are pushed; the docs wiki is served from `dev/wikis/pom/current`; `wiki.omp.loca.zone` was left untouched.