fix: make audit gates evidence-backed and correct stale check-count claims

- wire npm audit (prod + full dev tree) through readGate instead of hardcoded NOT RUN reasons
- record real results: production 0 vulns PASS; dev tree 16 dev-only advisories FAIL, disclosed with reach and remediation
- docs/VERIFICATION.md: six checks -> seven, add package-metadata section and mutation row, record executed row-7 proof
- README/SETTINGS: replace six-gate wording with the actual gate ledger

scripts/release-manifest.mjs

@@ -53,6 +53,8 @@ const gates = {
   structuralVerification: readGate("00_admin/validation/structural.json", "node scripts/verify.mjs"),
   themeSchemaValidation: readGate("00_admin/validation/theme.json", "theme schema validation"),
   npmPackDryRun: readGate("00_admin/validation/pack.json", "npm pack --dry-run"),
+  productionDependencyAudit: readGate("00_admin/validation/audit-prod.json", "npm audit --omit=dev"),
+  fullDevelopmentTreeAudit: readGate("00_admin/validation/audit-dev.json", "npm audit"),
 };
 
 const releaseDate = new Date().toISOString().split("T")[0];
@@ -89,8 +91,8 @@ const release = {
     structuralVerification: gates.structuralVerification,
     themeSchemaValidation: gates.themeSchemaValidation,
     npmPackDryRun: gates.npmPackDryRun,
-    productionDependencyAudit: { status: "NOT RUN", reason: "Requires network access to npm registry" },
-    fullDevelopmentTreeAudit: { status: "NOT RUN", reason: "Requires network access to npm registry" },
+    productionDependencyAudit: gates.productionDependencyAudit,
+    fullDevelopmentTreeAudit: gates.fullDevelopmentTreeAudit,
     ompPluginDoctor: { status: "NOT RUN", reason: "Requires Bun + OMP installation" },
     interactiveTuiSmoke: { status: "NOT RUN", reason: "Requires a live OMP terminal host" },
   },