docs(audit): plan post-W7 Rust remediation

[blakinio]

Purpose

Turn the four validated post-W7 Rust-client MEDIUM findings into one durable, bounded remediation execution plan without implementing any remediation.

Accepted decomposition

• R1-SECRET: secret lifecycle and truthful cleanup claims;
• R2-SHUTDOWN: nonblocking event-loop shutdown and bounded synchronous I/O, serialized after R1-SECRET;
• R3-ASSET-OPEN: discovery-first opened-object integrity remediation;
• R4-ARCH-POLICY: complete fail-closed allowed-edge policy preserving the current 19-member graph.

Delivered scope

Exactly three documentation paths:

• planning task and checkpoint;
• canonical remediation plan under the post-W7 audit path;
• exactly one ready-to-paste Codex prompt for the first package, R1-SECRET.

Live-state evidence

• exact base/main: d23edd0a8395deb586e2b93dd1954bb175243dc4;
• audit PR docs(audit): post-W7 Rust client audit #120 and archive PR docs(task): archive post-W7 Rust client audit #121 merged;
• canonical report and validator reconciled;
• open PRs feat(ui): prototype Oteryn login shell #23, ci: prove official Tibia login without OCR on Synology #48 and fix(client-assets): verify configured release archives #97 inspected;
• PR feat(ui): prototype Oteryn login shell #23 shared-document lease is preserved and not overlapped;
• current required Rust and repository CI identified.

Boundaries

No Rust implementation, manifest, Cargo.lock, workflow, dependency policy, architecture rule, test or external-repository change. No implementation worker launches before this plan and its separate task archive merge.

Validation

Complete changed-file/content review and exact-head emitted CI are required before readiness/merge.

Task

OTC2-20260801-post-w7-remediation-plan