Account for the second review, and stop the evidence trail depending on a branch

[404SecNotFound]

What this changes, and why

Documentation and one test. No detector code.

Two problems, both found by asking "is anything left?" after #11 merged rather
than by a check failing.

REVIEW-RESPONSE.md accounted for one of two reviews. It carried all 21
findings from the review of f3acbf53 and none of the 22 from the review of
main at 21068b6, while presenting itself as the place every finding is
accounted for. That is exactly the failure the document exists to prevent: a
response that quietly drops findings reads as coverage while being a selection.
The second review's full table is now in, including the fact that makes it
readable — thirteen of its findings were marked "Reconfirmed" because they were
reconfirmed against a tree that had never received the fix. Fourteen were
already closed and invisible, six were real and are fixed, two are accepted and
cannot be closed by editing this repository.

The commit citations depended on a branch ref surviving. Each closed finding
cites the commit that closed it, and #11 was squash-merged — so those commits
are not ancestors of main, and a clone reaches them only through
claude/cohaera-third-security-review-oaa6dd, left frozen at the pre-merge
head. A real evidence trail resting on a branch nobody had promised not to tidy
up. Citations are now links to the commits on GitHub, which keeps a pull
request's commits permanently, so they resolve whatever happens to any branch.

Evidence

• The defect was reproduced first. Both were: grep -c "F-0[1-9]..."
  on REVIEW-RESPONSE.md returned 0, and a --single-branch clone of
  main resolves none of the cited commits.
• I mutated the fix and the test failed. Mutations tried: a citation
  whose link points at a different commit than its text; a citation for a
  commit that does not exist. Both fail. The accounting test was also
  confirmed to fail with any F-nn removed.
• python -m pytest tests/ -q passes. 851 tests.
• python tests/test_evasion.py unchanged — 26/26.
• ruff check passes. mypy src/cohaera clean.
• python tools/readme_facts.py --check passes.

If this changes detection

n/a, because nothing under src/cohaera is touched. The evaluation card is
unchanged and was not regenerated.

If this changes an evasion

n/a, because no evasion is affected.

Anything a reviewer should push back on

The citation test can now skip, and a skip is not a pass. Three cases: the
objects are present and every citation is checked; the clone is shallow and says
so; or the objects are absent because this clone has no branch ref, which is
reported as "I could not look" rather than "the citation is false". I think
that is right — those are different answers, and collapsing them is how a false
negative gets a green tick, which is the objection this repository is built
around. But it does mean a clone without the branch never verifies the
citations, and somebody could put a bogus SHA in and only CI would catch it. The
format and text-versus-link checks still run unconditionally, which is the
mitigation. If you would rather it fail hard, say so.

Where this branch came from. #11's branch is now load-bearing — it is the
only ref from which the cited commits are locally reachable — so this work went
onto a fresh branch off main rather than force-pushing that one. Same
reasoning as the note at the bottom of #11: please don't delete either branch,
though after this change the links survive it if you do.

---

Generated by Claude Code