docs: R1.6 is closed — say how it is held, not that it is broken

[stormer78]

What

CLAUDE.md's "Known open defect — R1.6 persist-before-ack" section describes
work that has since landed in both repos, and prescribes a fix that is already
done.

Left as-is it tells a reader the wallet can silently lose a
task-consent/request — that a gated action can skip its human check. That is
no longer true, and it is the worst kind of stale doc to leave sitting in a
security-relevant path: it invites someone to "fix" something that works, or to
distrust a guarantee they actually have.

Both halves are in place

• @openvtc/vti-didcomm-js 0.6.2 (commit 77dd700, "hand off inbound
  messages before acking") — _dispatchFrame awaits _deliver, which awaits
  onMessage, and only then acks.
• The plugin persists before returning — onInboundMessage in
  src/offscreen.ts awaits putPendingInbound as its first action, with the
  boot drain in offscreen.ts and background.ts, and
  tests/inbound.ack-ordering.mjs pinning the ordering.

The installed and declared dependency is ^0.6.2, so the fixed contract is
actually in use rather than merely available.

What replaced it

A section on how the property is held, which is what the next person
actually needs. It names both halves, and makes two things explicit that are
not visible from the code that depends on them:

• The ^0.6.2 floor is a correctness constraint, not a version preference.
  An older transport acks first and silently reintroduces the defect.
• What breaks it: dropping the await, moving the persist behind a branch,
  adding a message path that skips it, or relaxing the dependency floor.

It also records why pending.ts is separate from dedup.ts — dedup answers
"have I already prompted for this?", pending answers "is this still
outstanding?", a message can be both, and that is why the drain path bypasses
the dedup check.

The binding-rules entry is updated to match: "satisfied — and easy to break
again" rather than "currently violated".

Test

Documentation only; no code changes.