docs(phase-20): address review-bot + reviewer findings

Closes the three CRITICAL findings + four HIGH findings from the
multi-agent review and the bot comments that have a clean doc-only fix.

CRITICAL fixes:

- F-24-01 (CRITICAL): added §3.1 "Prior-state acknowledgement" that
  resolves the staging_ttl_days collision with the already-shipped
  EvaluationConfig.staging_ttl_days. Phase 21 deprecates the
  evaluation field via DeprecationWarning + alias-forward to the new
  retention.staging_ttl_days; removal targeted v0.7.0 per
  docs/standards/release.md cadence.
- F-24-02 (CRITICAL): same §3.1 entry resolves the closure-plan
  §15.5 GH-23 conflict between top-level retention.* (this design)
  and ingestion.retention.raw_documents.ttl_days (legacy GDPR docs).
  Top-level retention.* wins; Phase 21 updates the user-manual
  gdpr.md page in the same PR; closure-plan GH-23 entry will be
  amended when Phase 21 ships.
- F-24-03 (CRITICAL): added §5.4 "Personal-data minimisation across
  every audit-event field" — per-field classification + hash policy
  for category-3 (personal-data-bearing) fields. target_id in row
  mode is hashed via SHA-256(salt + value); error_message is routed
  through the existing _http._mask_secrets_in_text + PII regex mask
  helpers; everything else is genuinely operational. Phase 21 ships
  test_target_id_hashed_in_audit_event regression.

HIGH fixes:

- F-24-04 (HIGH): §4.2 flag table revised — line-number fallback for
  --row-id REFUSED; directory mode REFUSED; multi-row matches in a
  single file aborted unless --row-matches=all opt-in; new --yes flag
  required for unattended use (interactive without --yes prompts on
  TTY, exits EXIT_CONFIG_ERROR on non-TTY).
- F-24-05 (HIGH): §4.3 exit codes aligned with the project-wide 0/1/2/3/4
  contract; --check-policy returns code 3 (EXIT_EVAL_FAILURE) when
  violations exist (was: always 0); code 4 (EXIT_AWAITING_APPROVAL)
  for the interactive-confirm path.
- F-24-06 (HIGH): §4.4 atomicity rewritten with strict event ordering
  (data.erasure_requested FIRST before any deletion, then rewrite,
  then data.erasure_completed). Step-5 and step-6 failure recovery
  paths spelled out with named regression test
  test_partial_commit_emits_failed_event.
- F-24-08 (HIGH): §6 marketing-claim revision now carries an explicit
  scope-limitation paragraph naming what the operator remains
  responsible for (replicas, downstream consumers, webhook receivers,
  legal-hold copies). New data.erasure_warning_external_copies event
  fires when a webhook target is configured.

MEDIUM fixes (selected high-value):

- F-24-09 (MEDIUM): §3.2 audit_log_retention_days docstring rewritten
  with accurate Article 12(2) (6-month floor) + Article 11 (10-year
  high-risk) + GDPR Article 30 (≥3y) reasoning; default 1825d
  justified as middle-of-the-road horizon.
- F-24-11 (MEDIUM): §5.1 audit-event catalog grew from 3 to 6 events —
  data.erasure_warning_memorisation, _warning_synthetic_data_present,
  _warning_external_copies are now properly specified (previously
  referenced 3× without spec).

BOT fixes (gemini, qodo, sourcery):

- gemini-mtime: §3.3 new section "mtime caveat (and the in-band age
  field)" — retention check prefers the audit-log timestamp where
  available (HMAC-signed, can't be touch'd), falls back to mtime with
  age_source notation in the JSON output.
- qodo-line-count: §12 sign-off updated with actual line count (445
  vs claimed ≈460); v2 additions enumerated.
- sourcery-typo: "spec'es" → "specifies" in design intro + CHANGELOG.

DEFERRED (not in this PR):

- F-24-07 (HIGH) full §8 file-map enumeration (16 → 20 files): folded
  into Phase 21 implementation PR description per its closer scope.
- F-24-10 (MEDIUM) acquire_run_lock spec + Windows fallback: still
  Phase 22 ISO/SOC 2 design scope per closure-plan §15.5 Round-5
  carry-over; Phase 20 references it but does not specify it.
- F-24-12 (MEDIUM) TR mirror file map: Phase 30 final doc sweep
  scope; Phase 21 ships EN side first.
- F-24-13 (MEDIUM) distributed-corpus deletion: explicitly out of
  scope per §11; already documented.
- F-24-14 (MEDIUM): --yes flag now in §4.2 table; no-tty behaviour
  spelled out.

Closes (review IDs): F-24-01..06, 08, 09, 11 + gemini-mtime,
qodo-line-count, sourcery-typo

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: cemililik

CHANGELOG.md

@@ -21,7 +21,7 @@ All notable changes to ForgeLM are documented here.
   scope of Phase 21's `forgelm purge` implementation.  Maps every Article
   17(1) trigger to a ForgeLM action; enumerates the seven artefact kinds
   that may carry personal data; specifies the `RetentionConfig` Pydantic
-  block (Article 5(1)(e) storage limitation); spec'es the three new
+  block (Article 5(1)(e) storage limitation); specifies the three new
   audit events (`data.erasure_requested` / `data.erasure_completed` /
   `data.erasure_failed`); resolves three Wave 1 carry-overs (GH-023, GH-013,
   Round-5 concurrent-approve lock), six open questions; supplies the