docs: bring the handoff up to date with the batch and what verified it

The "there is uncommitted work in the tree" section is retired: the batch is
four commits on `ontology-sweep-clusters`, unpushed, master untouched.

Records what the gate actually bought. The batch was type-checked, linted and
looked finished, and `cargo test --all-features` still failed on five
non-nullable entities that resolve unavailable -- with the generalisation, since
it will recur: a fix that stops a reader lying usually makes some entity
nullable, and the declaration does not follow on its own. Both defects here were
introduced by honesty fixes.

Also records what is *not* verified, which matters more than what is: doc-tests
and example execution never ran, `cargo +1.88 check` could not run so the MSRV
is inferred rather than built, and one Windows machine says nothing about the
other two platforms.

Adds two lessons where they belong rather than in a changelog. The guardrail
table gains the gap `b2dd07b` came out of -- nothing compares a reading's
provenance against its entity's declared provenance, and the durable test is
"may resolve stronger, never weaker" rather than equality. And the flake from
`2e6f9e9` is written up by its profile: passes single-threaded, passes in
isolation, fails only under full parallel load, which is precisely the shape
that gets dismissed as noise.

Finally, the Defender quarantine that ate most of the session, with its
symptoms and the warning not to reach for `rustup toolchain uninstall` -- which
was tried here and made it worse.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>