feat: v2.18.0 — Certification Refresh (§Phase 16 milestone 62)

[SoundMatt]

Summary

• Retires the pre-replacement REQ-ZONE-*/REQ-CMD-*/REQ-STATUS-* requirement groups (20 entries) that milestone 61's closeout explicitly left untouched, removing the matching // fusa:req/// fusa:test annotations and Catch2 tags from rcp/rcp.hpp/tests/test_rcp.cpp while leaving the C++ types themselves in place (still depended on by rcp/config.hpp, per milestone 60's closeout).
• Regenerates HARA.md/.fusa-hara.json, TARA-ANALYSIS.md, CYBERSECURITY.md, and AUDIT_PACK.md against the full v2.x stream/endpoint/register-map requirement set — existing OS-*/H-*/SG-*/A-*/T-* IDs are kept stable (so SAFETY_PLAN.md's references stay valid), but every mechanism reference is repointed from the removed Zone/Command/Controller model to the real v2.x module (e2e::RxSequenceGuard/RxStreamGuard/RxWatchdog, watchdog::Manager, lifecycle::ServerLifecycle, regmap::Ep0, authz::AccessPolicy, discovery::DiscoveryClaim, tls::SecureClient/SecureServer).
• Adds a new H-011/SG-011 hazard/safety-goal pair for the E2E CRC mechanism (rcp/e2e.hpp, v2.6.0) — the roadmap's own stated most safety-relevant new surface in this whole effort.
• Replaces the three formal-verification TLA+ specs (AntiReplayGuard.tla, HealthStateMachine.tla, WatchdogProtocol.tla) — none of which modelled any mechanism actually present in this tree — with RxSequenceGuard.tla, CrcSafeStateLatch.tla (new coverage), and WatchdogSafeState.tla, each with a checked-in .cfg and verified for real with TLC 2.19 (Model checking completed. No error has been found.). This also closes a pre-existing gap: the old specs had no .cfg files, so FORMAL_VERIFICATION.md's documented java -jar tla2tools.jar tla/*.tla invocation would have failed outright.
• SAFETY_PLAN.md: two mechanism-table rows citing now-retired ids (REQ-CMD-005, REQ-PQ-001, the latter already stale since milestone 61) are repointed to their real v2.x replacements (REQ-WDG-002, REQ-SEQ-002) — a minimal, targeted fix, not a full rewrite of that file.
• version.hpp/CMakeLists.txt bumped to 2.18.0.
• fmea.csv/fmea.json, safety-case.*, tara.json/tara.md, sbom.json, provenance.json, gap reports, sas.*, sci.json, audit-pack.zip, fusa-badge.svg, report.json/report.html, qualify-report.json are deliberately not touched — .github/workflows/release.yml mechanically regenerates all of them from cpfusa against .fusa-reqs.json/.fusa-hara.json/source on the next tag push, same as every prior milestone.
• README.md is left unmodified — it already predates milestones 44-61 (still documents deleted packages like rcp/firmware.hpp) and bringing it current is a separately-scoped task this milestone's own text doesn't name.
• ROADMAP.md's milestone 62 section gets a "Done (v2.18.0)" closeout paragraph, matching the style of milestones 44-61.

Test plan

• cmake -B build -DCMAKE_BUILD_TYPE=Release -DRELAY_BUILD_CLI=ON -G Ninja && cmake --build build --parallel — clean build, 0 errors
• ctest --test-dir build --output-on-failure -j1 — 53/53 tests pass
• cpfusa check — 0 errors
• cpfusa lint — 0 errors (matches CI's own invocation, which runs without a prior CMake build so no FetchContent'd build/_deps/catch2-src is ever present)
• cpfusa cyber — 0 errors
• cpfusa trace --req-coverage 100 — Total: 417 Annotated: 417 (100.0%) Tested: 417 (100.0%), 0 dangling ids
• cpfusa qualify — 8/8 passed
• relay conform --strict build/cpp-rcp — PASS (§12.1/§12.2/§12.3), unaffected since this milestone touches no wire-format or CLI-surface code
• All three new TLA+ specs individually verified with tla2tools.jar (TLC 2.19): RxSequenceGuard (Monotonic, NoStaleAcceptance), CrcSafeStateLatch (LatchIsSticky, NoLatchWithoutEnforce), WatchdogSafeState (LatchIsSticky) all report no error found
• Cross-checked every REQ-*/SG-*/OS-* id referenced across the rewritten docs against .fusa-reqs.json/.fusa-hara.json — all valid, no new dangling references