docs(audits): split hotcrm's 69,419 hand-written test lines three ways (#15418) (#15431)

Measured read-only against objectstack-ai/hotcrm at 71a3452. Every one of the
169 files was read; nothing was classified by filename.

  (1) platform should derive it   20,505 lines  ~129,752 tokens  29.5%
  (2) the app's own judgement     28,242 lines  ~208,252 tokens  40.7%
  (3) platform behaviour, app pays 15,265 lines  ~97,972 tokens  22.0%
  (4) undecided                    5,407 lines   ~30,610 tokens   7.8%

The subtraction the card asks for comes out at zero: `os verify` derives CRUD
type-fidelity round-trips and the RLS cross-owner invariant, neither of which
corresponds to any hotcrm bucket-(1) test — and hotcrm does not depend on
@objectstack/verify at all. The remainder is the whole of bucket (1).

Token figures use hotcrm's own ratchet rule (check-source-token-ratchet.mjs
stripComments, blank-stripped, chars/4), which reproduces its published
authored total of ~135,830 for src.


Claude-Session: https://claude.ai/code/session_01UHvF5hyiZjnCyExFnfQB8m

Co-authored-by: Claude <noreply@anthropic.com>

Author: hotlong