docs: sync release status with completed accounting and repository gates

[Altairpaca]

Why

The public release/status docs still described #6 and #21 as open blockers and described plugin isolation/live-provider work as if the later #42/#44 changes had not landed. That makes the repository itself give stale instructions to humans and coding agents.

What

• mark protected-main (P1: protect main and require CI #6) and accounting v12 (P2 accounting: corporate actions, lots, taxes, and identifier validity #21) as completed evidence;
• narrow the first stable-release gate to genuine remaining host/data acceptance (P2 architecture: single local daemon, authenticated identity, and isolated integrations #23/Local acceptance: live providers, private research corpus, and release data semantics #34);
• record the Tencent live-provider subset and Linux bwrap subprocess runner without overstating their host-level acceptance;
• sync the M6 research status with integrity remediation fix(research): enforce provenance digest and knowledge-time integrity #48;
• keep post-release workflow/AI work deferred until real host/data evidence closes.

Boundary

No runtime behavior changes. This PR aligns the public system-of-work with already merged implementation and issue evidence.