docs(security): self-contain KEY-05 and PSBT; record the completed entropy migration

Verified the security subsystem's design-doc claims against code:

- KEY-05's foundational claims are accurate: entropy::draw_key_bytes exists,
  KeyGenRng is sealed with OsRng as its sole production member, MIN_GUARDED_LEN
  is 12, and core/clippy.toml bans rand::random/thread_rng exactly as stated.
- But its per-site table listed every production nonce/key site as disposition
  "migrate" (pending), when all of them have since been migrated to
  draw_key_bytes(OsRng) — storage_crypto, credentials/store, wallet/bdhke,
  mesh/x3dh — and zero rand::random/thread_rng remain in production. Added a
  completion note so the doc no longer reads as pending work.

Both KEY-05 and PSBT-SIGNING-ARCHITECTURE referenced
ENTROPY-SEED-AUDIT-2026-07-31.md five times as their evidence base — a doc that
was moved to local-only, so a public reader could not follow it. Reworded all
five to state the audit's findings inline ("the internal entropy audit found
...") without the unresolvable path. No published doc references it now. The
link-checker missed these because they were inline code, not markdown links.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/security/KEY-05-ENTROPY-ENFORCEMENT.md

@@ -2,12 +2,17 @@
 
 **Requirement:** ROADMAP `KEY-05`. 
 **Supersedes:** backlog `R-13`. **Absorbs:** `R-05` (duplicate-`rand` visibility) and `R-09`
-(CSPRNG-readiness record). **Resolves:** `F-10a` in
-`docs/security/ENTROPY-SEED-AUDIT-2026-07-31.md`, which recorded raw match counts and
-**deliberately declined to classify them**.
+(CSPRNG-readiness record). **Resolves:** `F-10a` from the internal entropy and
+seed-generation audit, which recorded raw match counts and **deliberately declined
+to classify them**.
 
 **Tree state this document was derived against:** `HEAD = c5a82cba` (2026-08-02).
 
+**Update:** every `migrate` disposition in the table below has since been applied.
+No `rand::random()` / `rand::thread_rng()` call remains in production `archipelago`
+code — each draws through `entropy::draw_key_bytes` from a named `OsRng`, and
+`core/clippy.toml` now bans both APIs, so a regression fails the build.
+
 ---
 
 ## Nothing here is broken today
@@ -206,8 +211,8 @@ lines are `core/archipelago/src/mesh/x3dh.rs:99` and `:113` —
 produced there; `:100` and `:114` draw only the `u32` `id` fields of `SignedPrekey` and
 `OneTimePrekey`. They remain in scope — they are values that go on the wire — but the
 characterisation "X3DH key agreement — key material" overstates these two specific lines.
-(The audit has since been corrected in place at `ENTROPY-SEED-AUDIT-2026-07-31.md:508`; this
-section records the derivation independently.)
+(The internal audit has since been corrected; this section records the derivation
+independently.)
 
 ---