docs(audit): refresh audit citations after main rewrite; glmGamPoi notices (#84)

<!--
SPDX-License-Identifier: CC-BY-SA-4.0
-->
## Summary

Follow-up to the memory / numerical / backend / warning-boundary audit
(landed on `main` in `4c2c79e`). Two things happened after that audit
was
written, and this PR brings it back in line with the tree it describes:

1. **`main` was rewritten to a new root.** `4a848da` (the revision the
audit
   was written against) and `4c2c79e` share **no merge base** —
   `git merge-base` returns nothing. `Execution.jl` moved +125/−60 and
   `estimation.jl` +231/−29, so a large part of the audit's `file:line`
   evidence no longer pointed at what it claims to.
2. **`glmGamPoi` dispersion landed** (issue #21) as a pure-Julia port in
   `src/analysis/dispersion.jl`. The notice catalogue was written when
   `glmGamPoi` was refused along with `local`/`mean`/`pooled`.

## Base check

- [x] Base is `hyperpolymath/MetaManifold-WebUI:main` (not the upstream
parent)

## Changes

**Re-verification (not just renumbering).** All 21 findings were
re-checked
against `4c2c79e`. Four of the six audited files are byte-identical
(`ilr_basis.jl`, `analysis.jl`, `provenance.jl`,
`bench/ilr_bases/benchmark.jl`)
so their citations are untouched; every citation into the two files that
moved
was re-located. The four headline findings were confirmed by **reading
the new
code**, not by trusting the old line numbers:

| finding | still reproduces at |
|---|---|
| M3 — `clr_table` written, never read for values | written 1164, read
for dimensions only 1167, 1182, 1183 |
| M4 — redundant full-table copies | 840, 858, 868, 989, 1062 |
| N1 — healing mixes scales (`epsilon` vs `log(1/epsilon)`) | 603, 608 |
| W1 — `is_dangerous` not updated when estimation is `:not_run` | 1682 |

**Catalogue corrections for `glmGamPoi`:**
- `estimation.dispersion_refused` — no longer says "use `parametric`"
for
`glmgampoi`; that method is now supported, and only `local`, `mean`,
`pooled`
  are refused by name.
- added `estimation.dispersion_glmgampoi_port` (method limitation /
warning) —
the dispersion estimate comes from this repository's port, not R's
glmGamPoi.
- added `estimation.dispersion_spline_refused` (fatal) — the spline
abundance
  trend at `SPLINE_TREND_MIN_FEATURES` (100) features is not ported.
- added `estimation.dispersion_pass1_fallback` (data quality / warning)
—
features with no pass-1 fit entered the dispersion estimate at their row
mean.

**Audit revision note** recording the rewrite, the re-verification, and
that two
pure-Julia kernels now exist (`dispersion.jl`, `zero_replacement.jl`) —
which
strengthens the answer to question 10 (reference path for a future
accelerated
implementation) without changing the gate: each still needs a published
conditions document, an independent oracle and a stated parity
tolerance, and
CI still has no recorded verdict on any of this code.

## Engineering checklist

### Required

- [x] `scripts/check-spdx.sh` passes (391 files; the two changed files
carry
      `CC-BY-SA-4.0`)
- [x] Conventional commit subject; SPDX headers correct
- [x] No secrets, credentials, or data included
- [ ] `bun run check` — **not run**: this PR touches only `docs/`, and
no
      frontend or Julia source changed
- [ ] `scripts/check-format.sh` / `check-lint.sh` — **not run**: both
target
source files, not prose; `check-spdx.sh`, which does cover `.md`, passes
- [x] No application-logic changes hidden inside a docs PR —
documentation only

### As applicable

- [ ] `CHANGELOG.md` — not updated: documentation-only, no user-visible
      behaviour change
- [ ] `docs/testing/coverage.md` — not updated: no test coverage moved

## Testing

Documentation only; no code path changed. Verification performed:

- `git merge-base 4a848da origin/main` → no merge base (confirmed
rewrite)
- byte-identity of the four unchanged audited files, by md5 of
  `git show 4a848da:<f>` vs `git show origin/main:<f>`
- each re-located citation anchored on the **content** of the cited line
  (e.g. `mean_first_i = mean(log_col[1:i])`, `is_dangerous =
  diagnostics.is_dangerous`), not on a blind offset
- an automated pass asserting every `Execution.jl:` / `estimation.jl:` /
  `ilr_basis.jl:` / `analysis.jl:` / `provenance.jl:` / `benchmark.jl:`
citation in both documents points at a line that exists in the current
tree
- `bash scripts/check-spdx.sh` → OK

## Note for the reviewer

**CI will not report on this PR.** Every `CI` workflow run since
2026-09-25 has
been `startup_failure` with zero jobs (`gh api …/jobs` →
`{"total_count":0}`);
GitHub's own verdict is "This run likely failed because of a workflow
file
issue." That is finding **B1** of the audit and it is not addressed here
— it
is owner-side, and it is the first of the preconditions for the backend
work
this audit was commissioned to scope.

This branch was also force-pushed: it previously carried the original
audit
commit `78da9ea`, whose entire patch content was already on `main`, so
the
rebase onto `4c2c79e` dropped it as "patch contents already upstream".
Nothing
was discarded — the content is on `main` byte-for-byte.

Co-authored-by: hyperpolymath <6759885+hyperpolymath@users.noreply.github.com>
Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>

Author: 3 people