chore(deps): bump truecopy 0.8.0 -> 0.10.3, strongroom -> 0.4.0

[askalf]

Summary

• Both pinned at a commit from 2026-07-16 — three weeks and (for truecopy) most of a full detection-hardening cycle behind. Flagged alongside the redstamp bump (chore(deps): bump redstamp v0.5.1 -> v0.7.5 #40) — this repo's whole pitch is "the call proceeds only when all three agree," which a month-old third of the trio undercuts — but bundled separately since neither is itself a proven live bypass the way redstamp#124 was.
• Also fixed a stale hardcoded "redstamp 0.5.1" claim in demo/audit-demo.mjs's own narration — it's actually running 0.7.5 now. Reworded to "since 0.5.1" (the feature's introduction version), matching how the README already phrases the same fact accurately. Checked the README for other version-pinned claims; none found.

Test plan

• Full suite — 17/17
• npm run demo / demo:mcp / demo:audit all clean end-to-end (redstamp/truecopy/strongroom composed)

[sprayberry-reviewer]

Automated review from the Sprayberry Labs fleet code reviewer.

Verdict: No blocking issues found — clean dependency bump, approving.

What I checked

• gh pr diff 41 — three files changed: demo/audit-demo.mjs, package.json, package-lock.json.
• CI check-rollup: CodeQL, test, and verify pinned tool surface (truecopy gate) all pass.
• No prior review exists on this PR at the current head SHA (41b7c65).

Findings

None blocking.

Minor (non-blocking): demo/audit-demo.mjs:64,77 — the narration string changed from "redstamp 0.5.1 ..." to "redstamp (since 0.5.1) ...". This is a wording clarification only (matching the PR description's stated intent to align with how the README already phrases the same fact), not a behavior change — no issue with it, just noting it's cosmetic/doc-only.

What's good

• Version bumps are consistent across package.json and package-lock.json (@askalf/truecopy 0.8.0→0.10.3, @askalf/strongroom 0.2.1→0.4.0), including the transitively-updated redstamp reference truecopy now resolves against.
• The stale-string fix is scoped and matches the PR's stated rationale; PR body notes the README was checked for other version-pinned claims and none were found.
• CI green across all checks including the security-relevant "truecopy gate" / "verify pinned tool surface" job.