Retoor goes security

That feels good. Not even started yet.

Seriousdevelopment Mode A is installed and active. Spec passed G0-ready review at overall A-.                                                                                                 
                                                                                                                                                                                                
  What landed (10 new files, no source edits):                                                                                                                                                  
                                                                                                                                                                                                
  • SPEC.md (364 lines, under the 500-line roadmap trigger): 79 normative IDs, caps, floors, 5 launch gates, living-docs register, estimates, risks, 12 decisions, research log                 
  • BUILD-TRACK.md: M0 in review, M1-M4 not started                                                                                                                                             
  • docs/adr/0001-adopt-seriousdevelopment.md (method adoption) and docs/adr/0002-use-cpp-single-file.md (C++ override of house Python stack)                                                   
  • docs/runbooks/README.md, CHANGELOG.md, Makefile (C++-adapted targets), VERSION (0.1.0)                                                                                                      
                                                                                                                                                                                                
  Grades before fixes: completeness B+, consistency B+, testability B, estimation A-, traceability B+, overall B+. Three gaps found: FR-09 silent on WebDAV crypt, Gate 2 cited no IDs,         
  estimates omitted the legacy-reference note. All fixed without deleting content. After: completeness A, consistency A, testability A-, estimation A, traceability A, overall A-.