docs: back-fill §14 entries for #53/#57/#65/#59; add PR-body footer-strip rule - #76

Summary

Docs-only. Closes the docs/ARCHIVE.md §14 record gaps identified in docs/reviews/STATUS.md § "ARCHIVE.md §14 gaps": four merged fixes landed without a dated §14 entry. Back-fills all four using STATUS.md's findings and the actual PR history (#53/#57/#59/#65, all merged 2026-07-13 into dev) as the source of truth. Also codifies a recurring PR-body hygiene rule in CLAUDE.md.

What changed

docs/ARCHIVE.md §14 — four back-fill entries (each dated to its merge date, 2026-07-13, and marked as a back-fill written 2026-07-20):

• fix(scans): require repository targets to be remote clone URLs (SEC-1) #53 — H1/SEC-1 — repository scan targets must be remote clone URLs; the local-path arbitrary-read (Trivy repo walking the container filesystem, bypassing SCRYE_FILESYSTEM_SCAN_ROOTS) is closed. The entry explicitly notes this SEC-1 is distinct from the older, unrelated webhook-URL "SEC-1" already in §14 (2026-07-05 P0 entry) to prevent future confusion.
• ci: SHA-pin workflow actions, expand Dependabot coverage, harden checkouts #57 — H9/SC-2 + H10/SC-3 — SHA-pin all Actions; expand Dependabot to pip/npm/docker/docker-compose + the composite-action dir; harden publish-workflow checkouts; converge the D3/SC-10/L25 version skew. Notes that the later ci.yml half of L24/SC-11 was logged separately in the fix: hop scanner JSON parse/normalize off the event loop (CON-4/H5) #67 CON-4 entry.
• docs: close CLAUDE.md compliance drift (D1, D2, R1–R8) #65 — D1/D2/R1–R6 — a short "compliance-drift closure" entry pointing at the already-logged deviations (R7/R8 already had their own §14 entries).
• backend: bump pytest 9.0.3, pytest-asyncio 1.4.0, black 26.3.1 #59 — backend dev-dependency bumps — pytest / pytest-asyncio / black; ruff deliberately held at 0.8.6 (bumping it would surface the D5b straggler).

CLAUDE.md § Git & PR conventions — new rule (with a matching 2026-07-20 §14 entry): after opening/editing any PR, re-fetch the live PR body and strip any auto-appended attribution footer ("Generated by Claude Code", a "🤖 Generated with…" line, a session/claude.ai link, a co-author trailer), so PR bodies carry no Claude/Anthropic identity — matching the existing commit-authorship rule. This footer has recurred on essentially every PR in this effort; codifying it gives a future session the rule to follow even if it doesn't catch the append.

Notes

• Docs only — no code, tests, Dockerfile logic, or CI behavior touched.
• Not merging — please review and merge into dev when ready.