Refresh the bundled key and align the security documentation

[Aevust]

Six commits, one theme: the key material, SECURITY.md and README.md
are brought back into agreement with the ratified text and with what
the code and the chain actually do.

Force-pushed on 2026-07-23 after an interactive rebase. Two commit
bodies were corrected and one sentence in SECURITY.md changed with
them; the other four commits are unchanged.

1  chore(security): refresh the bundled public key
2  docs(security): document the retrieval channels and fix citations
3  docs(readme): bring the README into line with the record
4  docs(readme): stop restating RIP statuses in prose
5  docs(readme): name the Core staging repository
6  docs(security): correct the repository labels in Canonical Sources

---

Key distribution (commits 1–2)

security/aevust.asc is refreshed rather than removed; SECURITY.md
positions it as the offline fallback behind the keyserver and WKD
rather than as the primary route.

The previous copy predated two changes: the 2026-06-26 signing
subkey and the 2026-07-20 primary-user-ID change. Every signature
made since 2026-06-26 comes from that subkey, so the stale copy
verifies nothing signed since then, and it presents the superseded
primary identity. The new file is the keys.openpgp.org copy, LF,
2,024 bytes armored, decoding to 1,308 bytes of OpenPGP data. The
primary fingerprint is unchanged:

ED20 B635 4EE4 526D 01F8 3B53 8B6E 3BF4 5C71 4ECA

SECURITY.md now documents all three retrieval channels — keyserver,
WKD, repository copy — with an explicit fingerprint check, a note on
the signing subkey, and a note that the channels may serve
byte-different copies of the same key: the keyserver and this
repository carry a superseded self-signature that the WKD response
does not, so the fingerprint rather than a file digest is what to
verify. That difference is exactly one packet — a superseded
2026-04-10 self-signature on the info@rincoin.org user ID — while
key material, subkeys and fingerprint are identical across channels
and either copy verifies the same signatures. Both WKD methods were
checked on 2026-07-23 and serve identical bytes.

---

Citations (commits 2–3)

The governance sections were relocated from RIP-0001 to GOVERNANCE.md
on 2026-07-07 (95c135c), incorporated by reference and without
normative change. Citations in SECURITY.md and README.md that still
pointed at RIP-0001 section names now point at GOVERNANCE.md.
Only the pointers move.

---

Factual corrections in README.md (commits 3–5)

• The Block 840,000 note described a "minimum-peer-version floor
  (PROTOCOL_VERSION 70018)" activating at that height. No such gate
  is adopted — a standing decision, not a deferral. What ships in
  v1.1.0 is capability signaling, the PROTOCOL_VERSION bump to
  70018 and the NODE_RIN3 service bit, and it ships with the
  release rather than activating at a height.
• The RIP-0002 status paragraph credited two phase boundaries as
  validated in production. The chain is past all three (210,000 /
  420,000 / 630,000), and the paragraph now says so.
• Core release references used the pre-rename numbering (v1.0.7,
  v1.0.8); they now read v1.1.0 and v1.1.1. The rincoin-sim archived
  artifact remains v1.0.7, the simulator's own version.
• The prose no longer restates RIP statuses. It had already drifted
  from the index — RIP-0004 was missing from the Draft enumeration —
  and each RIP's preamble is authoritative per RIP-0001 §RIP Status.
  What the prose keeps is what the index cannot carry: the evidence
  for RIP-0002 being Active and the reference-implementation state.
• The Core staging repository (rincoin-core/rincoin) is now named.
  The RIP-0009 and RIP-0010 reference implementations the text
  describes live there and have not reached the canonical
  repository, so the only Core link offered could not show them.
  The pointer states the authority relationship: staging carries no
  governance authority of its own, and only the canonical
  repository is authoritative for released Core software.

---

Repository labels (commit 6)

Canonical Sources in SECURITY.md labelled the canonical RIPs
repository "Development", contradicting RIP-0001 §Security
Considerations, the DNS TXT record published in the same file, and
the README; the Core entry named only the canonical repository. The
staging repository is now listed beside it with its standing stated
— no governance authority of its own; changes reach the canonical
repository only as reviewed pull requests, per GOVERNANCE.md
§Change Submission Discipline and Emergency Exception — and all
three repositories in the section carry an explicit label.

---

Out of scope, tracked separately

• RIP-0001 §Repository Structure lists security/*_public.asc; the
  actual file is aevust.asc. /rip-0001/ is gated, so aligning the
  pattern with the file is a separate PR through the review path.
• fix(ci): restrict GITHUB_TOKEN permissions in rip-check
  (CodeQL warning actions/missing-workflow-permissions).
• The @ysmreg fingerprint row remains (to be added) pending the
  Founder's input.

Neither GOVERNANCE.md nor anything under /rip-0001/ is touched.