fix(docs): resolve the dangling references and the code-scanning alert on this PR

Remaining CI failures on this PR, triaged to source rather than to name.

"HYPATIA" IS NOT A WORKFLOW

Triaged first because it looked like one. No workflow or job in this repository
is named `Hypatia`; the check-run comes from the GitHub Advanced Security app,
i.e. it is the code-scanning gate, and it failed because the SARIF upload from
this PR contained **1 new alert in code changed by this pull request**:

  .machine_readable/rsr-profile.a2ml
  warning: doc references `src/interface/` but no such directory exists in the
           tree (likely surviving a directory rename)

A true positive against my own new file, not a false one. The directory really
is absent (0 tracked files under src/interface/ in the canon), and the sentence
was declaring *that absence* — "no C-ABI seam and no formally specified ABI;
src/interface/ absent" — but written so that it read as a live path reference.
Reworded to state the same fact without the bare path token. The alert was not
dismissed and no scanning config was touched: the text is simply unambiguous now
about what it means.

TWO MORE DANGLING REFERENCES, FOUND WHILE LOOKING

Chasing that alert meant checking every path this PR's files point at, and two
pointed at a document that was never committed — `docs/binding/04-EXECUTION-*`
does not exist, and neither does `docs/binding/`:

  .machine_readable/rsr-profile.a2ml:37  "see docs/binding/04-EXECUTION-PLAN.md, ruling R-B"
  docs/AFFIRMATION.adoc:54               link:../binding/04-EXECUTION-PLAN.md[...]
  scripts/check-canon-lockstep.sh:98     "# See docs/binding/04-EXECUTION-PLAN.md."

These were references to a plan that existed only in conversation. A document
that cites a non-existent authority is worse than one that cites none: it reads
as though the argument has been made somewhere. Repointed at what actually
exists and actually says it:

  * the dialect note -> docs/AUDIT.adoc finding F3, which records that the law is
    authored in a superseded dialect while DEED is itself an unratified DRAFT
  * the ordering rule -> canon.lock [canon.lockstep], which is where
    "spine-adopts-then-canon-releases" is actually stated
  * AFFIRMATION's "We intend" list -> docs/AUDIT.adoc, which enumerates the
    release conditions those actions serve

A scan of every cross-reference in every .adoc and .a2ml this PR touches now
resolves; earlier it did not.

NO LOCK BUMP REQUIRED

`.machine_readable/rsr-profile.a2ml` is not named in canon.lock [canon.artifacts]
(criteria, gates, applicability, lifecycle, constitution), so a comment edit in it
is not a canon change and Gate A assertion 2 stays satisfied.

GATES AFTER

  Gate A, --canon standards  -> passed 8  failed 0  skipped 2  GATE A PASSED
  Gate A, --canon .          -> passed 8  failed 0  skipped 2  GATE A PASSED
  check-rsr-profile.sh .     -> OK — scaffold matches declared capabilities
  check-standards-map.sh     -> GATE D PASSED, entry_count = 120

(cherry picked from commit 236fcb8)

Author: hyperpolymath

.machine_readable/rsr-profile.a2ml

@@ -34,7 +34,8 @@
 // Dialect note: authored in the a2ml record dialect to match the shape
 // rsr-template-repo ships, because check-rsr-profile.sh's parser accepts it.
 // The .a2ml -> .deed conversion is estate task #64 and is deliberately NOT
-// attempted here; see docs/binding/04-EXECUTION-PLAN.md, ruling R-B.
+// attempted here; see docs/AUDIT.adoc — finding F3 records that the law is
+// authored in a superseded dialect while DEED is itself an unratified DRAFT.
 // ---------------------------------------------------------------------------
 
 [rsr-profile]
@@ -93,7 +94,8 @@ omitted-rationale = "The canon defines conformance; it is not an instance of it.
 //       — nothing consumes the canon as a library; it is consumed as a DOCUMENT
 //         and as a pin (canon.lock), which is not the `library` capability
 //   ffi / abi
-//       — no C-ABI seam and no formally specified ABI; src/interface/ absent
+//       — no C-ABI seam and no formally specified ABI; the interface directory
+//         is absent from this tree
 //   api-service
 //       — no network daemon; the reusable workflows RUN on GitHub's runners,
 //         they are not served BY this repo

docs/AFFIRMATION.adoc

@@ -50,8 +50,8 @@ Binding now. Each item is checkable against the anchor below.
 
 == We intend
 
-Committed next actions. **Not yet true.** Listed in execution order; see
-link:../binding/04-EXECUTION-PLAN.md[04-EXECUTION-PLAN.md].
+Committed next actions. **Not yet true.** Listed in execution order below; the
+release conditions they serve are enumerated in link:AUDIT.adoc[AUDIT.adoc].
 
 . Resolve ruling *R-A*: `machine-readable/` or `.machine_readable/`. This repo
   uses the dotted form in 97 files; the spine's `root-allow.txt` and this

scripts/check-canon-lockstep.sh

@@ -95,7 +95,7 @@ skip() {
 #   1. land the canon change with 3/4/5 informational  -> releases canon.lock
 #   2. land the spine's adoption against the released hashes
 #   3. turn --strict on, so drift is a hard failure from then on
-# See docs/binding/04-EXECUTION-PLAN.md.
+# See the [canon.lockstep] section of canon.lock, which states the order.
 #
 # softfail() — a REAL deviation. Promoted to a failure by --strict.
 softfail() {