docs: bring the specification in line with the accepted implementation

The operator ruled the implementation repo's main (50c8719) the latest
and accepted state. Sync the spec to it.

Accepted changes are reflected: one bare-metal environment, TrueNAS bulk
storage, R2 off-cluster backup, CloudNativePG, single-node VPN gateway
with Cilium fail-closed, inbound WireGuard, per-app auth sidecars,
Renovate, the CI gate as approver, and the pm-agent. New ADR-0017..0025;
ADR-0016 corrected and accepted; R-* IDs unchanged, eight amended.

Where the implementation has simply not met a requirement, the
requirement stands and the shortfall is recorded in docs/16-known-gaps.md.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

agents/task-board.md

@@ -1,14 +1,18 @@
 # Task Board
 
+> **FROZEN — historical seed.** By the operator's ruling of 2026-08-31 this board is not the status
+> surface; the repository is. **Nobody edits it**, and its contents and the instructions below no
+> longer describe live work. Its `T-*` IDs stay stable because the implementation repo cites them.
+> Live status: `./conformance/run.sh --status` in the implementation repo; dated snapshot:
+> [`../docs/16-known-gaps.md`](../docs/16-known-gaps.md).
+
 The live who's-doing-what. Agents **claim** an item (set Owner + Status) before starting, respect
 `Blocked-by`, and mark `done` only after its **automated, reproducible behavior test passes green**
 ([`definition-of-done.md`](definition-of-done.md), [`../docs/14-testing-and-conformance.md`](../docs/14-testing-and-conformance.md)).
 Seeded from [`../roadmap/phases.md`](../roadmap/phases.md) + [`../roadmap/workstreams.md`](../roadmap/workstreams.md).
 
-> **This board is the one working surface agents may edit** (claim items, update status, add
-> items/escalations). The specs, ADRs, and roadmap are **not** editable by agents (R-TEST-06) —
-> raise spec problems here as an `OQ-*` escalation for the human. Every "**Prove …**" task below is
-> an automated conformance test (co-owned with **WS-TEST**), not a manual demo.
+> The specs, ADRs, and roadmap are **not** editable by agents (R-TEST-06). Every "**Prove …**" task
+> below is an automated conformance test (co-owned with **WS-TEST**), not a manual demo.
 
 **Status values:** `todo` · `in-progress` · `blocked` · `review` · `done`
 **Add new items** at the bottom of the relevant phase; keep IDs stable.