v0.3.26 — round-2 semantic-audit fixes

v0.3.26

• fix REQ-017 (again): provision-windows-labview-vm.yml's credential-file cleanup only ran on the success path (set -euo pipefail means an earlier failure skips the end-of-step shred line entirely) -- replaced every end-of-step cleanup with a trap ... EXIT right after each file is written, so cleanup now fires on any exit path, success or failure, verified locally that explicit exit codes are preserved through the trap
• fix a real, 3-model-consensus documentation defect: docs/sbom-pipeline/procedure.md and README.md both mischaracterized Run-Pipeline.sh as "the native Linux SBOM pipeline" -- it is actually a separate, unrelated LabVIEWCLI MassCompile/VI Analyzer tool for NI's own example VIs, with zero SBOM/VIPM/Grype/DT stages (confirmed directly against the script's own header comment); there is no native Linux SBOM pipeline in this repo today, only the containerized one
• fix docs/sbom-pipeline/procedure.md's native-pipeline stage list: added the missing "Packages" stage (build.packages, vipm lock, signed builds), and corrected the Policy-gate/Publish stage ordering (Publish-DependencyTrack calls Test-PipelinePolicyGate internally as its last action, not as a separate preceding stage)
• fix docs/vm-provisioning/procedure.md's Ubuntu-LabVIEW complete-activation description: VIPM activation is genuinely automated (activate-vipm.sh's vipm activate --direct-vipm-io, per REQ-032), only LabVIEW activation stays human-only -- the doc previously claimed both stayed human-only, the same scope error already fixed in the wiki SRS
• fix docs/vm-provisioning/procedure.md's overclaimed "no built-in default" wording: several workflow_dispatch inputs do carry generic placeholder defaults (e.g. vm_name's example-windows11-labview2026-myproject); none default to any real fork's actual identity, which was the real intent, but the literal wording was inaccurate
• fix docs/cm/cm-plan.md's Change Control table: disclosed the real gh pr merge --admin bypass mechanism already documented in CONTRIBUTING.md, which the CM plan's "Operator review of the PR" claim omitted entirely
• fix docs/information-item-map.md's stale Baseline: v0.3.11 (14 releases stale)
• fix README.md's reusable-workflow pinning-format claim to match the real, recommended @<commit-sha> # <tag> format (it said @<tag> only, contradicting its own adjacent "Directly-invoked scripts" bullet and toolchain-smoke-test.yml's own canonical example)
• narrow wiki SRS REQ-013's wording to the base-OS ISO specifically (the auxiliary NSIS/service-bootstrap bootstrap media it also implied coverage for is only existence-checked, not hash-verified -- a known, separately-tracked gap, #63)
• all findings from this round found by repo-standards-review@v0.2.23's --mode semantic-audit, run across all 5 areas (REQ/ARCH/TEST/CM/DOC) with 3 independent models (Claude Opus, GPT-6-astra, Gemini-4-argon); the single most significant finding (provision-ubuntu-vm.yml has zero total dispatches ever and references 3 scripts that have never existed in this repo) needs an operator decision before it can be fixed -- filed as #62; #63 tracks 2 smaller follow-ups