track: address remaining audit findings F83–F114 from audit/02-static-audit.md

[ImmortalDemonGod]

What

The static audit at audit/02-static-audit.md recorded findings F83 through F114 in addition to F82 (corrected by PR fix/c2-f82). Each finding is an independent correctness/logic, security, or maintainability defect and requires its own investigation, plan, and fix PR.

Why deferred

Explicitly classified as nice-to-have / each is a separate PR in both .aiv/plans/c2-f82-plan.md §6 OUT OF SCOPE and the PR completion contract's OUT-OF-SCOPE REMINDERS:

"F83–F114 — each finding is a separate PR. No cross-finding scope creep."

Bundling multiple findings into a single PR violates the atomic-commit contract and makes evidence trails unmanageable.

Acceptance criteria

• Each finding F83–F114 has a dedicated GitHub issue (or is explicitly triaged as won't-fix with documented justification)
• Each actionable finding has a corresponding fix branch following the fix/c<stage>-f<N> naming convention
• Each fix PR includes an AIV packet (Classes A–F) and updates audit/02-static-audit.md to record CORRECTED: <commit-sha>
• After all findings are addressed, audit/02-static-audit.md contains no remaining open entries

Note on F85

F85 (_review_logic.py DB connection leak) is tracked separately because it was explicitly called out during the F82 pipeline.