[cpp-RCP-10] Two committed TARA documents analyze different subjects (cpp-FuSa tooling vs. the RCP protocol) #78

Location: tara.md / tara.json vs. TARA-ANALYSIS.md.

Finding: The repository carries two threat-analysis documents with different subjects. tara.md/tara.json (machine-generated by the cpp-FuSa tooling, ISO 21434, 8 assets) analyze cpp-FuSa's own tooling/CI/supply-chain surface — the release binary, .fusa.json, dispositions, CMake dependency-fetch mechanism — not the RCP protocol this repository implements. TARA-ANALYSIS.md (hand-authored, 9 assets) is the one that actually analyzes RCP protocol-level threats and cites real code in this tree. Having two committed TARAs that describe two different systems, with no note in either explaining the split, makes it ambiguous which one a certification reviewer should treat as the authoritative product-level threat analysis for this library.

Recommendation: Keep one clearly-labeled authoritative TARA scoped to the RCP protocol (i.e. TARA-ANALYSIS.md), and either remove the cpp-FuSa-tool-scoped tara.md/tara.json from this repo or retitle/relocate it clearly as tooling-process evidence, not product security evidence, so the two are never mistaken for each other.

Verification: Independently read all three files at current HEAD (commit 4b9449a, 2026-07-29). Confirmed tara.json's asset list (release binary, .fusa.json/.fusa-hara.json, CI pipeline, dispositions log, etc.) and TARA-ANALYSIS.md's stated scope (RC Client/RC Server communication under the governing spec's stream/endpoint/register-map model) are genuinely different subjects.

Filed from the 2026-07-29 ecosystem audit register; independently re-verified against current HEAD before filing.