spec: scope the Notary PostgreSQL correctness-state claims to exclude the audit pipeline

[jeremi]

Context

REQ-PR-NOTARY-041 lists audit inside "the PostgreSQL correctness state used for its transactions, pre-authorized codes, proof replay, evaluations, audit, and credential status", and REQ-ARC-G-013 places its correctness-state ownership list (which includes audit) directly next to the sentence requiring the Notary-owned PostgreSQL schema for production. The shipped architecture is different on purpose: the #356 cutover scoped replay, nonces, evaluations, idempotency, credential status, quotas, and preauthorization into postgres_state_plane_v1.sql, while audit remained the hash-chained sink pipeline whose evidence posture (retained-set tamper evidence plus required off-host shipping) was settled in #332. A reader of the current wording can incorrectly conclude that restoring the Notary PostgreSQL database restores audit state, or that active-active replicas share one ordered audit correctness state.

This is a documentation-scoping correction. It does not change runtime behavior, and it does not reopen the deferred checkpoint/anchoring (#62), shipping-visibility (#315), or HA-topology (#507) roadmap items.

Evidence

• docs/site/src/content/docs/spec/rs-pr-notary.mdx:287-291 (REQ-PR-NOTARY-041)
• docs/site/src/content/docs/spec/rs-arc-g.mdx:191 (REQ-ARC-G-013)
• crates/registry-notary-server/src/state_plane/migration/postgres_state_plane_v1.sql (no audit table)
• crates/registry-notary-server/src/posture.rs audit assurance object (hash_chain: process_local, checkpoints: unsupported, anchoring: none)
• docs/site/src/content/docs/operate/retention-and-persistent-state.mdx and operate/backup-and-restore.mdx (audit files handled separately from PostgreSQL state)

Scope

• Remove audit from the REQ-PR-NOTARY-041 PostgreSQL enumeration and state where audit correctness lives instead: the product-owned hash-chained audit pipeline with operator-owned durable sinks and off-host shipping per the deployment evidence gates.
• Clarify REQ-ARC-G-013 so the PostgreSQL-schema sentence is scoped to the state-plane domains (transaction, replay, evaluation, credential status) and audit ownership points at the audit pipeline requirements rather than the schema.
• Sweep both spec files and the requirements appendix for other sentences implying Notary audit state resides in PostgreSQL, and align them.
• Keep the LikeC4 model as is; it already models PostgreSQL and the audit pipeline separately and its semantic test asserts the Postgres relation excludes audit.

Acceptance criteria

• Neither REQ-ARC-G-013 nor REQ-PR-NOTARY-041 claims PostgreSQL stores audit state.
• The corrected wording names the audit pipeline, sink retention ownership, and off-host shipping requirement as the audit correctness boundary, consistent with runtime posture output.
• Backup/restore and retention docs remain consistent with the corrected requirements (no change expected; verify wording).
• The architecture model test asserting the Notary Postgres relation excludes audit still passes.
• Docs site checks pass (npm test and npm run check from docs/site/).