docs(audit): fold the 24 UNRESOLVED rulings (#1186) into rows.json + FINAL.md (t_12b66b00)

[ang-fleet-workers]

Folds the 24 rulings from #1186 (t_63023f77) into the canonical audit build. Card: t_12b66b00.

#1186 added UNRESOLVED.md + unresolved.verdicts.json but not lead/rows.json / FINAL.md / ROLLUP.md, so the canonical rebuild (#1274/#1296) still showed all 24 rows UNRESOLVED. This PR carries #1186's commit (cherry-picked, authorship kept), so merging it lands both; #1186 can then close as superseded.

Changes (docs/plans/fork-pr-audit/lead):

• rulings.UNRESOLVED_RULINGS loads unresolved.verdicts.json; one source, no second copy.
• final.build() applies it to the 23 code rows and asserts each was UNRESOLVED. The auto row nopr:08fc3aff65 follows nopr:8dcc69611c to DROP.
• build_all.py fails if any of the 24 rows ends with a verdict other than its ruling.
• render.py: the card column takes the ruling cards, plus the POST_RULING_2026_09_27 cards that left cards.json in docs(audit): make 2026-09-27 KEEP flips canonical in final.build(); reconcile cards.json #1296 (a bare re-render on main dropped those 8 ids). Hand-written tail sections survive a re-render. The §6 UPSTREAM count and the UNRESOLVED sentence are computed, and §3 lists the 4 new UPSTREAM rows.

Counts: KEEP 672→680, DROP 153→163, UPSTREAM 93→97, SUPERSEDED-BY-UPSTREAM 174→176, UNRESOLVED 24→0 (1,116 rows).

Verification:

• build_all.py (with the t_03e35f0e lead/merged.json) + render.py: the rows.json diff touches exactly the 24 ruling keys, and only the final + why fields. The FINAL column of each of the 24 FINAL.md rows starts with its ruling verdict. 0 UNRESOLVED rows are left.
• Running build_all + render again reproduces the committed files byte-for-byte (rows.json sha256 579de903…).
• Baseline check: the new render.py run on HEAD's rows.json reproduced HEAD's ROLLUP.md exactly. In FINAL.md it changed only the card column of the 16 rulings that have a card.
• ruff is clean. gitleaks --no-git findings are the same as HEAD (6, all pre-existing).

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[ang-fleet-lander]

🤖 merged-by: apollo · lane: kanban-merge-pass · gate: ADVISORY (FleetReview not green for d1f7df9): fleetreview-advisory-20260927-standing.md · why: t_12b66b00: fork-PR audit: fold the 24 rulings that fork #1186 added as files into lead/rows; Argus off card review (Ace 13:08), CI green

[ang-prism]

FleetReview

Review: post-merge · head 5f64cba949c8 · duration 10m 13s
Profile: full recipe · policy: below-size-and-path-gates
Roster: B-assert-ctx → gpt-6-sol (openai), B-state → gpt-6-sol (openai), C-assert-xhigh → claude-code-opus-5-5 (anthropic), F → gpt-6-sol (openai), G → grok-4.6 (xai), L6 → gpt-6-sol (openai)

Post-merge review (fleetreview:post-merge override): this reviewed the merge commit against its first parent — the bytes that already shipped. It is not a pre-merge gate pass.

Confidence: 3/5

Findings

• P1 docs/plans/fork-pr-audit/lead/rows.json:30997 — Unsafe DROP · agreed: B-assert-ctx (openai)
• P2 docs/plans/fork-pr-audit/lead/render.py:133 — Show the existing upstream branch for ruling test(tui): settle deferred rows before unmount compensation checks #695 · agreed: C-assert-xhigh,F,G (anthropic, openai, xai)
• P1 docs/plans/fork-pr-audit/lead/render.py:201 — Fail closed when a hand-written section marker is missing · agreed: C-assert-xhigh,F (anthropic, openai)

---

FleetReview provenance · models: B=gpt-6-sol, C=claude-code-opus-5-5, D=grok-4.6, F=gpt-6-sol · cost: $4.01 · duration: 10m 11s · rounds: 1 · files examined: 7