v0.1.0: H2 security/supply-chain/ops gates + CI repair (Node 24)

Scope

The recorded-dispatch and push CI runs on main (076600b) failed at
'Audit dependencies for known vulnerabilities': rustsec/audit-check@v2.0.0
could not publish its check run (Resource not accessible by integration), and
GitHub's Node 20 -> 24 forcing turned that publish failure into a hard step
failure (the identical error was swallowed under Node 20 yesterday; the audit
itself reports zero vulnerabilities).

Changes

1. Run cargo-audit directly (cargo install cargo-audit --locked --version 0.22.2;
   cargo audit) - same tool, lockfile, and .cargo/audit.toml the local gate uses,
   no check-run publishing. Same precedent as the gitleaks action removal (6462c60).
2. Move every remaining Node 20 action to its Node 24 major (versions verified via
   the GitHub API): checkout v7.0.1, setup-node v7.0.0, pnpm/action-setup v6.0.10,
   upload-artifact v7.0.1, setup-buildx-action v4.2.0, login-action v4.6.0,
   build-push-action v7.3.0, fetch-metadata v3.1.0.
3. Ledger: SPEC_CONFORMANCE.md updated (section 15 mechanism + E11 legend).

Verification boundary (honest)

ci.yml changes are verified by this PR's required CI. docker.yml and
dependabot-auto-merge.yml changes are config-only here: they execute at the next
v-tag and the next dependabot event respectively.

Closes #138